making staff local administrators

[rh91uk]

Written a quick little guide for Group Policy Preferences - doesn't explain what you need to do but should set you on your way, mess around with it if that is the way you want to go.

userslocalgroups.pdf

[john]

Very nice, you have too much time on your hands to be able to write them up that well I usualy scribble something down in Notepad thats about as fancy as I get due to time!

[jamesb]

Im just setting this up again, and whilst it works to give staff admin rights on the local machine, it seems to give them admin rights to every machine. IE, they can browse the c$ and d$ shares of every machine this applies to. How would I have it so they are only adminsitrator of the actual machine they are logged onto ?

 

As has been said, Group Policy will add the users as local admins of every machine, which will also make them admins of machines you are not logged on to. The other option is a login script which adds them as a local admin of just the machine they are logging on to, and a logoff script which takes them out of the group. This way they'll be able to administer a machine only when they're logged on to it.

 

Something like this should do it (taken from here):

 

Set oWshNet = CreateObject("WScript.Network" ) 

sUser = "fill in some domain user name here" 

sNetBIOSDomain = oWshNet.UserDomain 
sComputer = oWshNet.ComputerName 

Set oGroup = GetObject("WinNT://" & sComputer & "/Administrators,group" ) 
Set oUser = GetObject("WinNT://" & sNetBIOSDomain & "/" & sUser & ",user" ) 

' suppress errors in case the user is already a member 
On Error Resume Next 
oGroup.Add(oUser.ADsPath) 
On Error Goto 0 

[rh91uk]

Very nice, you have too much time on your hands to be able to write them up that well I usualy scribble something down in Notepad thats about as fancy as I get due to time!

 

Ssssssssssh, dont tell the boss!

[cookie_monster]

As has been said, Group Policy will add the users as local admins of every machine, which will also make them admins of machines you are not logged on to. The other option is a login script which adds them as a local admin of just the machine they are logging on to, and a logoff script which takes them out of the group. This way they'll be able to administer a machine only when they're logged on to it.

 

Something like this should do it (taken from here):

 

Set oWshNet = CreateObject("WScript.Network" ) 

sUser = "fill in some domain user name here" 

sNetBIOSDomain = oWshNet.UserDomain 
sComputer = oWshNet.ComputerName 

Set oGroup = GetObject("WinNT://" & sComputer & "/Administrators,group" ) 
Set oUser = GetObject("WinNT://" & sNetBIOSDomain & "/" & sUser & ",user" ) 

' suppress errors in case the user is already a member 
On Error Resume Next 
oGroup.Add(oUser.ADsPath) 
On Error Goto 0 

 

 

 

Do you need to run this script with admin rights to change the group membership? Our logon scrips run with the logged on user privilages so couldn't make the change.