Which is better - Local users & groups GPO, by computer or by user?

[TwistedHelixis]

Hi, I am in the process of moving away from restricted groups policy to Local Users & Groups for controlling local admin accounts.

 

I have noticed that users & groups is listed under both computer and users policies.

 

Our restricted groups policy was set under the computers policies, but think I would prefer our new users & groups policy set under the users polices branch.

 

The instructions I am following only have it setup under the computers polices, but don't explain why. - Computer Configuration –> Preferences –> Control Panel Settings –> Local Users and Groups;

 

Can a few of you who use this policy check if you have this setup under computers or users.

[jthompson]

You're wanting to configure the local users and groups that each computer has, which is why you set it under Computer Configuration.

 

Group Policy settings under User Configuration are specific to the AD user(s) that the GPO applies to, so would have no scope for configuring computers' local admins.

[TwistedHelixis]

You're wanting to configure the local users and groups that each computer has, which is why you set it under Computer Configuration.

 

Group Policy settings under User Configuration are specific to the AD user(s) that the GPO applies to, so would have no scope for configuring computers' local admins.

What I want to do is assign some staff that are in AD as local admin users on any computer they log into.

[jthompson]

You can still do that under Computer Configuration.

 

Create a security group in AD for and add the relevant AD users to it. Then in a GPO, under "Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups" update the local administrators group to add your new AD group as a member. Apply that GPO to whatever computer OUs you need.

 

Since this touches on security and account separation practices, it's worth warning against applying the same setting to servers. You may still want to use the same method, but if so, do it with wholly different accounts and groups. I'd say this should go hand in hand with "Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > 'Deny log on locally' and 'Deny log on through Terminal Services'" to prevent your workstation admin accounts from logging into servers and vice versa.

[TwistedHelixis]

Thanks for the reply and sorry for more questions..... last ones I promise.

 

 

You can still do that under Computer Configuration.

 

Create a security group in AD for and add the relevant AD users to it. Then in a GPO, under "Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups" update the local administrators group to add your new AD group as a member. Apply that GPO to whatever computer OUs you need.

 

This is basically how I have it setup using restricted groups, but wanted to see if it was possible to get away from that approach, for 2 reasons.

1, Under the computer policy I need to make sure every computer 'User x' might ever want to sit at has a policy applied, which is messy, rather than just having 'User x' in an OU with the Local Users and Groups policy applied.

2. An issue I have noticed with restricted groups set at the computer level is, 'user x' logs in at a computer they have never logged into before, but 'user x' is not made a local admin until the next time they reboot.

 

 

Group Policy settings under User Configuration are specific to the AD user(s) that the GPO applies to, so would have no scope for configuring computers' local admins.

Perhaps I am getting confused, but don't believe I want to configure the 'computers' local admins anyway.

On each computer we have disabled the main built-in administrator account, but do create a new one as default, lets call it setup_admin. I don't want to do anything with these accounts.

 

All I need is 'user x', who is in AD to get added to the admin group on her PC.

 

Does this have to be set using the computers policy, or can I use the users policy?

[jthompson]

I see what you're getting at. Worth bearing in mind that whilst you're not configuring a local user, you are still configuring a local group on the computer.

 

By doing it under User Configuration, that would make them an admin on all of your computers (and servers?) anyway, so perhaps better to do it under Computer config and limit the scope of that GPO to the required subset of computers.

 

Another approach you could look at (never tried this myself) could be to use item-level targeting. Where you have an item under Computer Configuration for updating a local group, you could enable the item-level targeting option in the 'Common' tab and set a condition there that the computer must be a member of a particular security group. You can then have a security group that contains whatever computers you want you user to have local admin on. So even if the GPO is being applied to more computers that you really want, that item-level targeting will allow you to be more surgical with which computers are affected.