+ Post New Thread
Results 1 to 9 of 9
Windows Thread, Make a power user an administrator on single machine in Technical; Is it possible to give a power user (with domain account) administrator privileges on a particular machine? I run some ...
  1. #1
    rocknrollstar's Avatar
    Join Date
    Jun 2008
    Location
    Hampshire
    Posts
    435
    Thank Post
    387
    Thanked 28 Times in 24 Posts
    Rep Power
    20

    Make a power user an administrator on single machine

    Is it possible to give a power user (with domain account) administrator privileges on a particular machine?

    I run some backup software on a machine where a teacher regularly logs in. The teacher account is a power user, and the software only runs automatically when logged in as an admin, otherwise it forgets it's settings.

    Many thanks.

  2. #2

    Join Date
    Jan 2009
    Location
    United Kingdom
    Posts
    226
    Thank Post
    22
    Thanked 9 Times in 9 Posts
    Rep Power
    13
    If you have any experience of Group Policy, you can do it using this!
    Create a new group policy object called: Local Staff Admin Account or similiar..
    Alter the settings of this gpo to follows:

    Computer Settings...
    Security Settings...
    Restricted Groups...

    Add a new group called administrators, and add the Staff user account or group to it (if more than one user uses the computer).

    If you have a domain administrator account or group of domain admin users who work on the network (e.g. techies), you will also need to add their specific group/usernames to the administrators group, you just created, otherwise their accounts will be locked down, when logging onto the machine as well.

    HTH
    Mark

  3. Thanks to _techie_ from:

    rocknrollstar (31st August 2009)

  4. #3
    rocknrollstar's Avatar
    Join Date
    Jun 2008
    Location
    Hampshire
    Posts
    435
    Thank Post
    387
    Thanked 28 Times in 24 Posts
    Rep Power
    20
    Great, thanks Mark- will give it a go!

  5. #4

    powdarrmonkey's Avatar
    Join Date
    Feb 2008
    Location
    Alcester, Warwickshire
    Posts
    4,859
    Thank Post
    412
    Thanked 777 Times in 650 Posts
    Rep Power
    182
    Forget group policy, it's overkill. Just use the computer management administrative tool on the local machine to add the user to the right group. (If you're doing this for 200 machines, by all means use GP, but it's a waste for just one.)

    Edit: in fact, the method in post #2 will do this for all machines, not the single one you want.

  6. Thanks to powdarrmonkey from:

    rocknrollstar (1st September 2009)

  7. #5
    rocknrollstar's Avatar
    Join Date
    Jun 2008
    Location
    Hampshire
    Posts
    435
    Thank Post
    387
    Thanked 28 Times in 24 Posts
    Rep Power
    20
    Thanks powdarrmonkey. Yes, I was thinking that I would have to put the single pc in a seperate OU to make the GPO method work. Is a definite solution, but will do it locally on the machine.

    Thanks for your help.

  8. #6
    DrPerceptron's Avatar
    Join Date
    Dec 2008
    Location
    In a house
    Posts
    918
    Thank Post
    34
    Thanked 134 Times in 114 Posts
    Rep Power
    41
    You can filter GPO's by PC, Group or User... it doesn't have to apply toAuthenticated Users (ie: everyone & everything).

    When you show it in the right pane from under Group Policy Objects in the GPMC, you remove "Authenticated Users" from the Security Filtering and either create your own group of computers it applies to, or list the computers in the filtering individually.

    NB: Aren't Domain Admins automatically added into the Local Administrators group?

  9. Thanks to DrPerceptron from:

    rocknrollstar (2nd September 2009)

  10. #7

    Join Date
    Jan 2009
    Location
    United Kingdom
    Posts
    226
    Thank Post
    22
    Thanked 9 Times in 9 Posts
    Rep Power
    13
    Quote Originally Posted by DrPerceptron View Post
    NB: Aren't Domain Admins automatically added into the Local Administrators group?
    Yes normally, if you don't specify anything under the group policy, but if you specify elevated privileges for a group or user, you also need to add your administrators/techies accounts.

    HTH
    Mark

  11. Thanks to _techie_ from:

    rocknrollstar (2nd September 2009)

  12. #8
    mark's Avatar
    Join Date
    Jun 2005
    Posts
    3,958
    Thank Post
    248
    Thanked 49 Times in 45 Posts
    Blog Entries
    2
    Rep Power
    46
    Surely you only need to grant access to the files/ folders and or reg keys for that particular software on the PC for domain users. Then any user logged into the PC will be able to run the backup software without risking making the user a full admin.

  13. Thanks to mark from:

    rocknrollstar (2nd September 2009)

  14. #9
    rocknrollstar's Avatar
    Join Date
    Jun 2008
    Location
    Hampshire
    Posts
    435
    Thank Post
    387
    Thanked 28 Times in 24 Posts
    Rep Power
    20
    Thanks for your replies. The user I wanted to grant access to wasn't a domain admin. I've added them to the local admin group via the computer management console- software seems to be running as if the user was an admin, so all ok!

    Thanks for your suggestions

SHARE:
+ Post New Thread

Similar Threads

  1. SQL single user mode
    By AnnDroyd in forum MIS Systems
    Replies: 3
    Last Post: 21st January 2008, 12:19 PM
  2. Make a script run for SINGLE domain user
    By philtomo-25 in forum How do you do....it?
    Replies: 5
    Last Post: 15th November 2007, 09:21 PM
  3. Replies: 6
    Last Post: 5th June 2007, 02:35 PM
  4. sql server single user
    By Uraken in forum Windows
    Replies: 0
    Last Post: 18th May 2007, 12:29 PM
  5. PC power Button (shut machine down)
    By edie209 in forum Windows
    Replies: 11
    Last Post: 19th June 2006, 09:47 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •