User with desktop admin rights but not server admin rights

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I would like to create a security group, that I can include users into, so
that these users can be on any workstation on the domain and install
software, but they cannot add users, or add computers to the domain without
an Administrators intervention. So I have four contractors coming in, they
will be touching each desktop and laptop on the domain to run updates and
remove and install software, but I don't want them to have access to the
servers, so no domain admin rights. How can I do this?

Thanks ahead of time.
2 answers Last reply
More about user desktop admin rights server admin rights
  1. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    They need to be members of a security group that is a member of the local
    administraors group on each PC.

    Run this on each machine "net localgroup Administrators
    your_domain\Groupname /add"
    or use
    Use Restricted Groups in a GPO
    http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

    --
    Regards
    Mark Dormer
    How to ask a newsgroup question:
    http://support.microsoft.com/kb/555375


    "Brent Johnson" <BrentJohnson@discussions.microsoft.com> wrote in message
    news:A9C64214-4D66-4FCB-B50F-971A5ECD08C6@microsoft.com...
    >I would like to create a security group, that I can include users into, so
    > that these users can be on any workstation on the domain and install
    > software, but they cannot add users, or add computers to the domain
    > without
    > an Administrators intervention. So I have four contractors coming in, they
    > will be touching each desktop and laptop on the domain to run updates and
    > remove and install software, but I don't want them to have access to the
    > servers, so no domain admin rights. How can I do this?
    >
    > Thanks ahead of time.
    >
  2. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    I struggled with the group policy, but adding the net command to the logon
    script worked perfectly. Thank you so much.

    "Mark Dormer" wrote:

    > They need to be members of a security group that is a member of the local
    > administraors group on each PC.
    >
    > Run this on each machine "net localgroup Administrators
    > your_domain\Groupname /add"
    > or use
    > Use Restricted Groups in a GPO
    > http://www.windowsecurity.com/articles/Using-Restricted-Groups.html
    >
    > --
    > Regards
    > Mark Dormer
    > How to ask a newsgroup question:
    > http://support.microsoft.com/kb/555375
    >
    >
    > "Brent Johnson" <BrentJohnson@discussions.microsoft.com> wrote in message
    > news:A9C64214-4D66-4FCB-B50F-971A5ECD08C6@microsoft.com...
    > >I would like to create a security group, that I can include users into, so
    > > that these users can be on any workstation on the domain and install
    > > software, but they cannot add users, or add computers to the domain
    > > without
    > > an Administrators intervention. So I have four contractors coming in, they
    > > will be touching each desktop and laptop on the domain to run updates and
    > > remove and install software, but I don't want them to have access to the
    > > servers, so no domain admin rights. How can I do this?
    > >
    > > Thanks ahead of time.
    > >
    >
    >
    >
Ask a new question

Read More

Domain Desktops Security Windows XP