Local Admin account on XP Pro SP2

[boryan]

I have users set as administrators on their own workstations all running XPPro SP2. They are regular users on our domain. When they log on, they always always log on to the domain, not onto their local machine, duh, since that's the point of a network. So since they are not administrators of the domain, they cannot do anything update-wise on their local machine. Cannot update Windows, cannot update Office, cannot do hardly anything. I don't want to walk around to their desks to do this updating for them. So what am I doing wrong? When go to User Accounts, it indicates that John is Administrator of Computer1. It also shows that John is User of mydomain. (Because I always also add their domain account to the user accounts hoping that somehow this will fix the problem). They use the same user name and passwords for both accounts. When you log onto the domain instead of the local machine, does it not also look at your credentials on the local machine to see what group you belong to?

 

[linney]

810796 - White Paper: Software Update Services Overview White Paper

http://support.microsoft.com/default.aspx?scid=kb;en-us;810796&FR=1&PA=1&SD=HSCH

http://www.wsus.info/Articles/

Registry change for Windows Updates XP Pro
thread779-884263

http://www.microsoft.com/windowsserversystem/sus/susdeployment.mspx

The Domain User Group controls the access rights of these local machine administrators while logged into the Domain. You will find if you look in the Documents and Settings folders of the local machine you have two username folders with the same username but differentiated by the added prefix of .domain-name for the domain users.

 

[Seumas13]

If you really want everyone to have Admin rights over their local PC, add "Domain Users" to the PC's local Administrators Group.

Or if you want to be a bit more selective, go to each PC and add the local user's DOMAIN login to their local Administrators group.

Let me know if this helps...

Seumas
Martinez, CA

 

[boryan]

Thanks for both of these tips -- I really do want these users to have admin rights on their own PC, so I think I'll try adding Domain Users to the PC's Local Admin Group and see if that works. This has been vexing me for some time. Thanks again for your fast responses.

 

[franklin97355]

If you want users to be admins only on their own computer just add their domain\username to the admin list. We go one further by having each school a group so we add domain\usergroup to the admins then when someone moves or leaves we just modify the group membership.

 

[boryan]

I added "domain users" to the PC's Local Admin Group and it works like a charm. Thanks for all your help. We have so few users (about 13) and they all do the same kind of work, so groups don't really work and are an unnecessary administrative task in our small office. Everybody uses the same software and does the same thing.