How can I give administrative control to workstations?

[TiggerDaKat]

We have 20 PC's that need all users that login to have local administrative access to their PC's.
If they don't have administrative access, certain plugins in IE will not run properly.
I thought I could do that by adding the PC's in AD to the domain computers folder (if they aren't already in there) then giving that group administrative rights on each workstation. It didn't work.
Any ideas?

Thanks in advance.

Eric

 

[pixboy]

Start menu, Control Panel, Administrative Tools, Computer Management. Find Local Users and Groups and click on Groups. There's a group there called Administrators. Add the domain user in question to that group, and voila ... they're a local administrator!

 

[TiggerDaKat]

What if I have 25 users, all accessing the same machine....we have 20 machines? There has to be an easier way to set the workstation security level for the whole group without having to go to each machine each time we add a new user that needs access....
Any other ideas would be greatly appreciated.

Thanks in advance.

Eric

 

[Shearergol]

How about making a new group on the domain called "workstation admins" and adding that group to each machine administrators group?

OR.....just add the "everyone" group to the local admin group on each PC?

I'd advise against it though.

 

[dholbrook]

Bad idea Shearergol, the "everyone" group includes ALL logons, including Guest!


Tiggerdakat,

This is a classic global group requirement. Create a global group in the domain to hold all the 25 users that need this local admin level access (see, only once is enough!). All admin work (adding and removing users) on this group is then done only at one point, at the DC.

Next you must add this global group to the local administrator group on each of the machines that has this requirement (yes, you must do it once on each of the 20 machines, but then you are done there).

This will work, but you have a bigger problem. I would find out why you have such a requirement and fix the problem with the plug ins that need Admin level access to work. You DO NOT WANT users to have Admin level access to all these systems, or you will find them installing all kinds of little "neat" garbage onto the systems they log in to, or deleting files and programs they do not understand a need for, and now you will have 20 systems that develop weird problems for no reason to troubleshoot.

NO application, plug in, etc., should require the users to have Admin level access, period. Fix the real problem, don't make it worse.

By the way, if you have 25 users loggin in to 20 different systems, you had better set up roaming profiles for all these users with home directories on a single home server or you will have severe disk space shortages on each of the 20 systems after awhile. Remember that all of these user (who never clean out temporary internet files, etc.) can easily create many tens or hundreds of megabytes of entries under "Documents and Settings" in each system they log on to and your net traffic load will suffer also. Do the math, 25 users x 100 MB each = 2.5 GB of storage used in your system directory on each system! Plan Ahead and avoid the system crashes from lack of drive space! Forcing a standard desktop configuration would also help control the space size.

HTH

David