Script for Changing Local Admin 1

[DJCopa]

Hi All.

We had to set all our staff as Local Admins when we set up shop about 6 years ago (staff were unable to connect to our CRM correctly without it). We are now at a stage where this is no longer required, and the need to lock down PC's is more important (VUNDO infections have been a nightmare).
Ideally, we do not want to visit each PC and set Local User group from Admin, to User. Is there a script or some other automated process that people here have used? I have Googled a fair bit, but can only find info on changing local Admin password.

Thanks in advance.

 

[gmail2]

If you want to have the same users in the local admin group on each machine, then have a look at restricted groups. This should do what you want it to.

Best of Luck

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau

 

[Sympology]

Are these seperate pc's or part fo a domain? If a domain you can use AD policies.

Only the truly stupid believe they know everything.
Stu.. 2004

 

[DJCopa]

Thanks for the response guys.

I thought that local permissions would take precedent over anything else? As local users are all Admin on their own PC's (Domain) I would need to change this first, to stop installation of software?

Ideally, I'd then like the option to pop up to allow install with admin account - Would save us having to log off profile and log in as Admin to install software.

 

[gmail2]

In that case you want restricted groups. Restricted groups are for centrally controlling membership of local groups. By defining a policy under the scope of the computers it will overwrite any current membership with whatever is configured in the policy. Also, because it overwrites the membership every time the policy is applied, it elimiated privilege escelation.

It will not prevent you from using run as or any other utility to install software however

Hope this helps

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau

 

[DJCopa]

Cheers gmail2 - Appreciate the quick come back!

Will give it a whirl!

 

[gmail2]

No problem ... we've had restricted groups implemented in our environment now for about 3 years without any issues, but if you do have any problems, post back

Good Luck

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau