Windows – How to remove local administrator permissions

group-policypermissionswindows

I want to disable the permissions of local administrators in the machines of my domain, is this possible?, and only put administration rights to the Domain Administrators. And I want to do it with Group Policies.

Mainly I want to disable the permission of install/uninstall programs to the users, although they are Local Administrators of their machines.

Best Answer

Take the users out of the "local admins" groups.

The manual process would be to go to the computer, start > rc my computer and then "Manage Computer". Select "Local user and groups", "groups" then double click administrators. Remove the users from that group.

Probably best not to take Domain Admins out of this group though, and if you disable the local administartor group from doing anything, you may have other issues.

You may find that a lot of things will stop working for the users though, so Power Users might be the best place for them to go if they've done anything weird and wonderful.

If you wanted to do this by group policy, I think you'd be looking at scripting something, then having it run as a startup script.

Your script would then use "net localgroup administrators naughtyusers /delete"

Related Solutions

Security – How to lock down workstations and still support legacy applications that require local administrator rights

It's rare that a software package actually needs admin rights, but rather it's writing to an area of the registry or hard disk that admins normally have access to and other users do not. That might sound like nit-picking but its fundamental to nailing this issue.

You can use the process monitor edit: thanks grawity tools from Microsoft to monitor what the applications are doing, and allocate rights to those areas to the users. http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

You can then use Group Policies to apply security ACLs to both files and folders and parts of the registry. A common cause of this problem is the program writing to either/or it's installation folder in c:\program files, or its global settings on the machine registry under HKey Local Machine.

Can the users can apply Windows update without local administrator rights

Computer -> Administrative Templates -> Windows Components -> Windows Update
Allow non-administrators to receive update notifications

This group policy setting controls whether users need admin rights to install updates. If you lack GPO control over the systems, then use the equivalent registry hack:

HKLM\Software\Policies\Microsoft\Windows\Windowsupdate
ElevateNonAdmins
DWORD, set it to 1

Note that this setting only works up through Vista; in 7 it has no effect and admin rights are required for update installation.

Best Answer

Related Solutions

Security – How to lock down workstations and still support legacy applications that require local administrator rights

Can the users can apply Windows update without local administrator rights

Related Topic