Remove users as local admin 1

[withanh]

We recently got a new VP of IT and he wants us to remove the local admin rights of all our users. Unfortunately 75% of our users are field based and I can't get my hands on them easily.

I'm hoping there's a way to remove the users from the Local Administrators group via Group Policy, I'd even take a VB script if that would do it.

My domain is 2008 R2 and 99% of my workstations/laptops are XP Sp3.

Thanks if anyone can help.

Darhl

 

[58sniper]

Discussed here many times - look into Restricted Groups

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[withanh]

Yes, I saw restricted groups, but from what I can tell and from my testing that's more for adding users to the local admins group than for removing people from the local admins group.

My issue is all my remote/laptop users are already set as a local admin, I need to remove them from the local admins group.

 

[withanh]

I guess it's fair to mention that I was able to use Restricted Groups to add a user to the local admin's group, then I was able to remove that user from the local admin's group.

However, I have not been able to use it to remove an already existing user from the local admin's group.

Darhl

 

[PScottC]

A Restricted Groups policy will wipe the contents of the target group and populate it with the list in the GPO. If you aren't seeing this behavior, then you haven't configured it correctly.

PSC
[—] CCNP [•] CCSP [•] MCITP: Enterprise Admin [•] MCSE [—]

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[withanh]

Evidently I was having a dense moment (or two). The documentation I was reading said to create a domain group then use Restricted Groups to add/remove membership in that group.

I stumbled across another article that said to not create a new group, but to just put in the name of the existing group you're configuring. i.e. DOMAIN\Group, it struck me that if I omitted the DOMAIN\ it might configure the local group. I tried that and it worked.

Darhl

 

[PScottC]

No... Don't browse for the group name. Simply type Administrators, then type the names of the members starting with Administrator and <Domain>\Domain Admins.

The system will do name resolution at the time the group policy is applied. The SIDs are not stored with this particular policy.

PSC
[&mdash;] CCNP [&bull;] CCSP [&bull;] MCITP: Enterprise Admin [&bull;] MCSE [&mdash;]

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[withanh]

Thanks PScottC, I appreciate the clarification on that!

Darhl