Local user groups

[edutech4schools]

hello, I am in the process of locking things down a bit and want to remove all the teachers from the local admin account which is deployed via GPO using restricted groups.

 

Q1 - What group should I apply to the staff? They are using Windows 10 if that makes any difference.

Q2 - When the gpo was created we were using server 2008r2, we are currently on 2012r2, is it the same process, or has it changed?

 

Thanks

[Joanne]

Pretty sure it is the same. Is there a power user option? Rings a bell.

 

If you just remove them from it they will need a username and password anytime they want to install anything (eg/ adobe / java etcs)

Edited June 28, 2016 by Joanne

[edutech4schools]

Found while Googling that apparently the new way uses Group Policy Preferences, but I don't have any time to check.

 

Restricted groups is the old way but will work on all servers & GPP is newer but will only work on 2008 or newer.

 

Seeing as we have a 2012r2 server Ill do some more research when I get some time, unless someone wants to help me.

[Joanne]

I do it this way and it works with Server 2012 R2 and Windows 10.

 

 

but you would need to change that BUILTIN\Administrators bit. Check what groups are available on a test client first and add them to the one you want.

Edited June 28, 2016 by Joanne