Group Policy - How Do I Lock Down Local Administrator Accounts?

[MattyP1983]

Hi All,
I currently work for a medium/large company and was wondering if possible to lock down local administrator accounts via group policy. We seem to have people messing around with their passwords on a regular occasion and i would love to stop is all, all input on this would be great received.

Many Thanks, In desperate need.

Matt

 

[rkalk]

Matt, I believe I am reading this as; all of your users have domain admin rights. Is this correct? Or; that all of your users have local admin rights. Is that correct?

If they are using local accounts you need to change this if you have a domain controller. Do not allow your users to have local admin rights. That is if you expect to maintain control of your environment.

Please advise so I know how to direct you.

 

[5jgibbs]

Ya, its called "don’t give them administration privileges" haha lol

When you create a new user, you add permissions to that account via a users group. I would suggest making a group, and adding user permissions to that group that you want your users to have. Then i would suggest making an OU "organizational unit" and then setting GP for that OU...

I would also invest in software called fortress 101 if your going to be working with a large/med sized network.


anyway, yes, you can make your GP on an OU then you can restrict groups as shown in this screen cap i made..

 

[5jgibbs]

 

[mlichstein]

was wondering if possible to lock down local administrator accounts via group policy. We seem to have people messing around with their passwords on a regular occasion

As noted above, administrators are administrators. You can't lock down an admin. You can't prevent an admin from changing the password on any of the accounts local to the particular box they are an admin on.

Users should never be local administrators. Yes there are many poorly written apps that require admin rights, but they can be worked around by using regmon, filemon and runas. Making everyone an admin on their box leads to the problems you are posting about, but it also substantially increases the risk for a virus/spyware/malware/worm outbreak.