A couple of questions....

[garethedmondson]

I wonder if anyone can help me with a couple of questions:

1. What is the GPO setting to add Domain Admins to the Local Admin security group? I've set:

Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups

I've added 'Domain Admins' to the 'Administrators (built-in_ group'.


2. The second problem is the mapping of drives. It doesn't seem to be happening. I'm not sure what I'm meant to do. I've set the user policy to pick up with a 'Replace' action. I can access the drives through the normal run command

[bio]

for q1: How to Add domain accounts to Local Administrators Group using GPO - Richard's myITforum Blog
for q2 : I allways create logon scripts that maps drives. Its easy to create and placed in the netlogon folder and no GPO needed at all.

bio..

[garethedmondson]

for q1: How to Add domain accounts to Local Administrators Group using GPO - Richard's myITforum Blog
for q2 : I allways create logon scripts that maps drives. Its easy to create and placed in the netlogon folder and no GPO needed at all.

bio..

Hi Bio,

Thanks for that. Q1 - Done that but couldn't get it to work for some reason.

Q2 - Isn't the point of Windows 7 to reduce the need for scripts. But I do take your advice on board and will look at that.

Gareth

[garethedmondson]

Q1 advice still doesn't seem to work. If I right click on 'Computer' and 'Manage' I am prompted for credentials. I thought this would have gone. When I put in my credentials for a domain admin I get

'Explorer.exe
The requested operation requires elevation'.

Gareth

[DMcCoy]

I wonder if anyone can help me with a couple of questions:

1. What is the GPO setting to add Domain Admins to the Local Admin security group? I've set:

Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups

I've added 'Domain Admins' to the 'Administrators (built-in_ group'.


2. The second problem is the mapping of drives. It doesn't seem to be happening. I'm not sure what I'm meant to do. I've set the user policy to pick up with a 'Replace' action. I can access the drives through the normal run command

1) Domain admins get added to the local admin group automatically when you join the domain.
2) Does it work as a non local admin? If the drives are mapped when elevated they you may not be able to see them in explorer. Do they show in an elevated command prompt?

[garethedmondson]

1) Domain admins get added to the local admin group automatically when you join the domain.
2) Does it work as a non local admin? If the drives are mapped when elevated they you may not be able to see them in explorer. Do they show in an elevated command prompt?

This is really odd - I know Domain Admins is added to the local Administrators group, yet I am still told that explorer.exe needs elevated privelages to work.

GJE

[bio]

for q1 : I see.... your problem is uac : Disable User Account Control (UAC) in Windows 7 - IIS Hacks | Server and System Administration

regards
bio...

[garethedmondson]

for q1 : I see.... your problem is uac : Disable User Account Control (UAC) in Windows 7 - IIS Hacks | Server and System Administration

regards
bio...

Hi Bio,

Sorry not replied - our LEA based filtering has gone belly up and nobody can access anything such as Edugeek (Webchat). Anyhow, I've done the above but am still getting the credentials prompt when I try and open 'Manage' after opening the menu on 'Computer' from the Start Menu.

I can enter the details but am told that I need elevated privs' - it's really weird as I know it should be working. The other GPOs are kicking in (except the drive maps). I'll try it again tomorrow and will recreate the GPO.

Gareth

[garethedmondson]

Morning,

Everything seems to be working now with Domain Admin. UAC was the issue and I turned it off.

The black background issue has been solved with a registry edit but the mapped drives for Admin users is causing me issues.

I've tried some information found here:

Group Policy Preference fails to map drive for local admins when UAC is enabled.

But for some reason I do not have permission to edit this registry key from my domain admin account. I've created the GPO to do it (Computer GPO not user), but it still doesn't catch.

If it doesn't work then I guess scripting is the only way to map the drives - but I was trying to avoid that.

Gareth