Adding domain users to Power Users Group via script or Group Policy 1

[windowsfan]

I need to remove domain users group from Administrators Group
and
need to all domain users to Power Users group on all PC's in the network (this included 2000, XP and Vista)

and
Change password administrator password on all PC's

What is the best way I can accomplish this (script or a Group Policy)?
Please let me know how?

 

[58sniper]

[google]Restricted Groups[/google]

Pat Richard MVP

 

[windowsfan]

I want to domain users to local power users group and remove domain users from local administrators group, how can I make this work using restricted group?

confused with members and members of Tab?
How will Restricted GP see local groups.?

 

[windowsfan]

I can add domain user to members Tab, now how do I add Power user to members of Tab?

Can I also change password for local admin via group policy?

 

[58sniper]

Restricted Group, as mentioned in the documentation, makes the desired group match what the policy says. Set the Restricted group for Administrators to just Administrator, and for Power Users, add the domain admins.

If you don't specify a member using Restricted Group, it will get removed from the group if it exists. For example - if you use Restricted Groups for the local Administrators group, and don't specify any members, then the policy will REMOVE all members.

Curious as to why you don't want domain admins in the local admins group?

Pat Richard MVP

 

[windowsfan]

I am going to add domain admins to administrators group but want to remove domain users which are member of administrators group.
how can I add local groups to members of Tab, when I try to browse and look for power users group of local computer it does not work
do I just need to enter text power users (for xp,2000, vista and it will work?)

is there a way to change the password of local admin on all pc's in same GP?

 

[Davetoo]

Yeah, I'm with Pat on this curiosity thing. Why wouldn't you want domain admins to be a member of the local admins group? That seems a bit odd given the nature of networks today.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[58sniper]

Run the GPMC from a workstation. I generally have better luck browsing for groups that way.

Pat Richard MVP