Archived from groups: microsoft.public.win2000.group_policy (
More info?)
Nick-
I'm not sure what making your users local admins has to do with granting or
denying access to runas. Runas is usually used to grant some temporary
elevated privilege and since they are already local admin--they have all the
privilege they need. And being local admin doesn't give them any ability to
get to domain-based resources that they would otherwise.
But, in any case, you can use GPO-based Services security policy to disable
the "Secondary Logon" service on those workstations, which will disable the
ability to use runas--but of course if they are local admins they can always
go in and re-enable the service anyway, so I'm not sure how much it buys
you.
Hope that helps anyway.
--
Darren Mar-Elia
MS-MVP-Windows Management
http://www.gpoguy.com
"Nick Fletcher" <nick@stevens-bolton.co.uk> wrote in message
news:40d9a2c1$0$298$ed9e5944@reading.news.pipex.net...
> Hi all
> Does any one know if there is the facility to disable the Run as command
via
> GPO please?
> We have had to make our users local admins on the PCs so we would like to
> remove this function.
> Thanks
> Nick
>
>
Facebook
Twitter
Instagram