Automatically add staff to local "Administrator" group?

[ramsay]

Hi,

 

New Windows 7 installation.

 

We used GP[1] to add (AD group) members of "Staff" to the local "Administrator" group. This seemed to work OK (members of "Staff" had local admin rights) but about a month later people started to get stuck logging in at "applying local user and groups policy". I removed this setting in GP and the issue went. Some months later I put it back and the issue returned the next day. At least I'm happy to have narrowed it down!

 

How do you give "local admin" access for staff members automatically? Or does the GP setting work for you?

 

[1] we put the GPO in an OU containing computers. The setting is under "Computer config, Prefs, Control panel, Local users and groups".

 

Thanks

[PeteSeddon]

Hi Ramsay,

 

Could I just ask why you are giving users local admin access instead of just power users?

 

Have you tried assigning the GP to an OU containing users? Also I take it your FRDC is 2008 R2?

 

Pete

[ChrisMiles]

Computer settings do not apply on user login, they apply on startup so I would guess there is another setting in the policy or something. Try disabling the user configuration settings on that group policy and see if it still does it.

[ramsay]

> Could I just ask why you are giving users local admin access instead of just power users?

 

I don't mind what they to do their laptops. If they mess the software up I just re-image it which takes 5 minutes of my time.

 

> Have you tried assigning the GP to an OU containing users? Also I take it your FRDC is 2008 R2?

 

It should be a computer configuration, as otherwise the user will be a local "Administrator" on any computer they use.

 

> Computer settings do not apply on user login, they apply on startup so I would guess there is another setting in the policy or something.

> Try disabling the user configuration settings on that group policy and see if it still does it.

 

That's what I thought, can't imagine why it's causing an issue when they are logging in! It is definitely that setting rather than the GPO as the GPO is still active, I just removed the one specific setting.

[sted]

Ist power users discontinued in win7?

2 ways of doing it iirc gpp preferences in the user section and i cant remember the other atm will look in morning

[Duke5A]

Your policy should look something like this. The blacked out area under Restricted Groups is just hiding the domain name.