Adding users to local admins or power users?

[l9nux]

Hi,

I run a 700 user network running Windows 2000, some XP and Active Directory. Currently, each PC has Domain Users as a member of the local administrators group. I want to change this so Domain Users is a member of Power Users on all PC's automatically. How do I do this?

I need the user to have some administrative access as we use some software that won't function without it. What does everyone else do?

One of the reasons I don't want Domain Users to be a member of the Local Administrators group is so that I can lock down control when using Software Update Services. I think Power Users would work.

 

[wolluf]

2 questions.

1. You could use something like psexec (part of pstools - freeware from

http://www.sysinternals.com)

with net localgroup to run jobs on all machines. There may also be features in 2k server to do this - but I have only limited experiecnce of 2k server... - 2k server forum might help.

2. Level of access for 'nomal' domain users is problematical. Some can get away with Power User access - some need full Admin. Suggest you try this out with all the software you use on the network and user with various levels of access (its the only way you'll actually find out). You may find for example that 99% of users can function properly with just Power User - in which case you can easily manage the 1% as special cases.

 

[l9nux]

I think you're right about the second question, as some of our financial software only works with local admin rights.

I might try and add a Kix script to do the job of group membership, so when users log on it will add domain users to the local admin group.

Thanks.

-=L9NUX=-

-= There's no place like 127.0.0.1 =-

 

[MCLowCash]

I am wanting to know how have all new users automaticly placed into the 'Power Users' group. For example if a new person logs in the domain, I'd like the local account to be in 'Power Users'. Is that possible? If so please help me out.

Thanks,
Tyler

 

[wolluf]

Tyler,

afaik, you have to update the Power Users group on each machine to include 'Domain Users'.