Prevent Local Admin account from being disabled

[anthonyaa]

Hi

Our users are all local Administrators and have the capability of disabling the local Administrator account. Is there a Group Policy that will lock the local Administrator properties so users cannot disable this account or change the local admin password?

Client - Windows XP Pro
Server - Windows 2003 Std

Thanks
Anthony

 

[jsauce]

Not really. If you set this option, then they could just change it because they are administrators. The only safe policy is to change their user credentials and not make them administrators. Make them power users or something lower instead. There only needs to be one Adminstrator account, and maybe one other account with total administrative priviledges.

John D. Saucier
jsauce@magicguild.com
Certified Technician
Network Administrator

 

[anthonyaa]

Unfortunately this cannot be done. All 500 of my users need to be local admins as we have critical apps that refuse to run as a Power User

Im hoping a group policy exists that can assist.

 

[Sympology]

May help, but we have apps that "require" local admin rights. Turned out nearly all of them just need permissions on the drive so that "Everyone" has modify access.
Stu..

 

[jsauce]

It really doesn't make any sense that all users need to be admins. You just need to figure out what permission they require and make sure it is set for those users. Try contacting the creator of the application and ask them what permissions are required and what permissions are not.

John D. Saucier
jsauce@magicguild.com
Certified Technician
Network Administrator