Pashers Posted December 5, 2008 Posted December 5, 2008 Hi all, Could someone please advise, I'm trying to find a way to add a group called Pupils to be local administrators. I don't think you do this in a script as the pupil may not have the priviledges to changes themselves to be local administrators!!? I'd prefer a bulk 'quick and easy' way if possible (I must be getting lazy tehehe). Thanks!
DSapseid Posted December 5, 2008 Posted December 5, 2008 Why on earth would you want pupils as local admins?
powdarrmonkey Posted December 5, 2008 Posted December 5, 2008 Disclaimer: this is a really bad idea. Anywho, you want the net command: Net accounts / Net user / Net group
DrPerceptron Posted December 5, 2008 Posted December 5, 2008 If you are using Group Policy you can do it easily enough... Computer Configuration > Windows Settings > Security Settings > Restricted Groups Right click, add the group you wish to join to another group (IE: Pupils) Then in the Member of box, click Add, then type Administrators (Do NOT search for it, because it won't find one ) 1
EduTech Posted December 5, 2008 Posted December 5, 2008 why the hell do you want to add pupils as Local Admin's Really bad idea
mpe Posted December 5, 2008 Posted December 5, 2008 Why on earth would you want pupils as local admins? A wild guess would be some broken piece of software. IMHO it would probably be better to fix the software. Including looking at permissions on files/registry keys it is trying to use. Giving users local admin privs has lots of unwanted side effects.
tonyd Posted December 5, 2008 Posted December 5, 2008 I'd REALLY worry about possibilities of local admins escalating privileges to become more powerful. You should be able to achieve much the same effect by allow full access to the local file system and registry, but without the same dangers elsewhere.
Pashers Posted December 5, 2008 Author Posted December 5, 2008 Thanks that worked brilliantly! I remember reading something about Restricted Groups somewhere but got scared lol. As for why I'm adding them as local administrators, I'm not 100% sure myself (I'm just the technician). However, I believe it makes life easy for us for installations, updates etc. Also for myself I've made a program in C++ to monitor the websites they go onto. Banning any sites it thinks/calculates should be banned (bit like surf control). Using a point value white list/black list set of words etc. Thanks again!!
strawberry Posted December 5, 2008 Posted December 5, 2008 Thanks that worked brilliantly! I remember reading something about Restricted Groups somewhere but got scared lol. As for why I'm adding them as local administrators, I'm not 100% sure myself (I'm just the technician). However, I believe it makes life easy for us for installations, updates etc. Also for myself I've made a program in C++ to monitor the websites they go onto. Banning any sites it thinks/calculates should be banned (bit like surf control). Using a point value white list/black list set of words etc. Thanks again!! it also makes life very very easy for them to break the machines be it intentional or unintentional. I cannot think of a single school i've known that has students as admins, heck most wont even allow teachers to be admins.
powdarrmonkey Posted December 5, 2008 Posted December 5, 2008 As for why I'm adding them as local administrators, I'm not 100% sure myself (I'm just the technician). However, I believe it makes life easy for us for installations, updates etc. Ye-es...but the downs will by far outweigh the ups. I've done it before, under instruction, and went along with it for a bit to illustrate the problems. We had to re-image multiple machines after a few days, and strangely I've never had the same request again Just remember, your users are now just as powerful as you, but without your expertise or experience or more importantly discretion. They will experiment, and they will break things.
elsiegee40 Posted December 5, 2008 Posted December 5, 2008 As for why I'm adding them as local administrators, I'm not 100% sure myself (I'm just the technician). However, I believe it makes life easy for us for installations, updates etc. For goodness sake, don't just do something because it makes life easy or because someone says so... question the reasons. It is shear madness to let anyone have administrative rights. Even I don't on my main logon. I use a special one if I need them. There are very, very few reasons for teachers to need them and none whatsoever for pupils. You are opening yourself and the school up for a lot of trouble.
Pashers Posted December 5, 2008 Author Posted December 5, 2008 it also makes life very very easy for them to break the machines be it intentional or unintentional. I cannot think of a single school i've known that has students as admins, heck most wont even allow teachers to be admins. If they did want to break the computers intentionally they can still easily make themselves local administrators with the free software out there these days. But considering the amound of fuss you lot are giving I'll deffo talk to the manager lol. One issue we have also had is the office 2007 package. If the pupils are not local administrators, then it keeps wanting to install it each time they run word! Any fixes/ideas on fixing this? (I know this is off topic)
DrPerceptron Posted December 5, 2008 Posted December 5, 2008 (edited) OFF2000: Windows Installer Appears Every Time a Program Is Started Have you tried a student as a Power User? it's still not the best solution, however, it's considerably more restricted than an administrator. Software Restrictions won't apply to any of your Pupils either if you are using them with Local Administrators as exceptions. Edited December 5, 2008 by DrPerceptron SRP 1
penfold Posted December 5, 2008 Posted December 5, 2008 Why has the request been made to make them local Admins? Is it by you for making your life easier when insalling/running software for them? Is there a NM who you work for who has authorised this? Or has the request come from a teacher who has purchased some educational software they want set up on their machines? You have to think of the long term implications of making changes like this. And as for pupils making changes using free software available...they shouldn't be able to do this with a secure network. That is the whole point of different groups of people having different levels of access. I would question whoever asked you to make this request, especially if it is you who is going to be running round correcting all the changes they make. There are always alternatives to achieve the outcome desired.
powdarrmonkey Posted December 5, 2008 Posted December 5, 2008 If they did want to break the computers intentionally they can still easily make themselves local administrators with the free software out there these days. Such as? One issue we have also had is the office 2007 package. If the pupils are not local administrators, then it keeps wanting to install it each time they run word! Any fixes/ideas on fixing this? (I know this is off topic) Yes, rebuild your default profile after installing Office. (copy the default profile over the local administrator's, log in as it, install Office, reboot, copy administrator's profile back to default, reset user's profiles so they pick it up.)
OutToLunch Posted December 5, 2008 Posted December 5, 2008 If they did want to break the computers intentionally they can still easily make themselves local administrators with the free software out there these days. But considering the amound of fuss you lot are giving I'll deffo talk to the manager lol. One issue we have also had is the office 2007 package. If the pupils are not local administrators, then it keeps wanting to install it each time they run word! Any fixes/ideas on fixing this? (I know this is off topic) Not easily, unless your workstations are set up with very lax security - for an easy way, they'd need a USB or CD boot into something like NTPasswd to reset one local admin accounts password, then get on and add themselves to that machine. It's not something that the majority of students would understand or be able to do - but the majority of students can easily accidentally break a PC by deleting system files if given the opportunity - ie you need a technically minded student to add just themselves, and they probably won't break anything (but one would question what they're up to if they're doing this) - but any normal user who wouldn't understand how to do this could still quite happily accidentally delete boot.ini, install spyware etc if they have local admin rights. The installer issue - you probably want to look into how you're setting up your default/mandatory profiles. If you have roaming profiles, it should run, but only the first time they use the package...
Pashers Posted December 5, 2008 Author Posted December 5, 2008 We do take away A LOT of privileges it's not like we allow them to browse the C drive, access the task manager, control panel, and so forth. The pupils are restricted via the Network's GP. Not even allowed to change passwords. It's not that unsecure lol
jamesb Posted December 5, 2008 Posted December 5, 2008 We do take away A LOT of privileges it's not like we allow them to browse the C drive, access the task manager, control panel, and so forth. The pupils are restricted via the Network's GP. Not even allowed to change passwords. It's not that unsecure lol You mean you did do all of that, up until them all being added as local admins.
powdarrmonkey Posted December 5, 2008 Posted December 5, 2008 We do take away A LOT of privileges it's not like we allow them to browse the C drive, access the task manager, control panel, and so forth. The pupils are restricted via the Network's GP. Not even allowed to change passwords. It's not that unsecure lol But if you give them admin rights, there are plenty of ways to get around that.
FN-GM Posted December 5, 2008 Posted December 5, 2008 We do take away A LOT of privileges it's not like we allow them to browse the C drive, access the task manager, control panel, and so forth. The pupils are restricted via the Network's GP. Not even allowed to change passwords. It's not that unsecure lol They could easily unplug the network cable while logging on to get round that.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now