Local Administration

[mjbosko]

Ok, this question pertains to a previous post.

If I have a user setup on my domain, and this user is in the Administrators group -- shouldn't he be able to execute tasks on his local computer without complaint??

For example, shouldn't he be able to install softare, run ipconfig/release from the dos prompt, install drivers from device manager, etc, etc??

Is there really no Local Administrator group, or something of the sort, that will easily allow me to state that a given user (or group of users) can perform these tasks?

 

[bofhrevenge2]

If this is an NT4 of above system then there is a local administrators group and anyone who is a member can perform and task on teh system.

Open computer management and there is a local users and groups applet in there.

http://www.microsoft.com/resources/...rd/proddocs/en-us/lsm_add_users_to_groups.asp

 

[bofhrevenge2]

Excuse my awful typing in the above post.

 

[mjbosko]

NT4, no. ?? Win2k3 Advanced Server.

Am I missing something?

 

[bofhrevenge2]

I they are a domain admin then they should be able to do anything unless domain admins has somehow been removed from the local admins group.
If you go to the users workstation and open computer management then you can add them to the local admins group.

Extra info, there are no local groups on a Win2k3 DC.

 

[mjbosko]

So having setup the test account as an Administrator is different than a Domain Admin.

Do Domain Admins have control over the PCs they are logged into, where Administrators do not?

That is, I setup my user account as a member of the DC Administrator group - but could not take control of my PC to install, etc. Are you saying that if I made myself a part of the DomainAdmin group, I would?

 

[bofhrevenge2]

1. An domain administrator will be a member of the domain admins group.

2. A domain admin is any account that is a member of the domain admins group and has administrative rights to anything that is a member of the domain. A local administrator only has administrative rights to the workstation on which the account resides.

By default the domain admins group will be a member of the local admins group
Tecnically the local admin is the most powerfull account as it can remove domain administrators from the local administrators group.

 

[bofhrevenge2]

As a test i would add the test account that you created to the administrators group on the local PC, this will give tham complete control over their PC.