Administrator Access

[mkshankarg]

Hi guys,

I want to know if local administrator on Windows XP clients can be blocked from logging on using GPO in Windows 2003 Server ? If possible how can I do it ? I want only the Domain Admin to be active and disable the local admin for all XP Clients.

 

[tfg13]

Don't recommend it, but you can push the disabling of the administrator account, under computer config->Windows Settings->Security Settings->Local Policies->Security Options->"accounts:Administrator Account status

 

[mkshankarg]

I dont want to disable the Domain Admin account. I just want to disable the admin account on the Client side. Is there a way to do it ?

 

[tfg13]

Here is a quicker way for you to do this:

strComputer = InputBox "On what computer do you want to disable the admin account?"
Set objUser = GetObject("WinNT://" & strComputer & "/administrator")
objUser.AccountDisabled = True
objUser.SetInfo

Save this as a .vbs and your local administrator accounts will be disabled. You may need to do some fine tuning, but this should work.