I’m not sure if this has been covered before, just finally figured out how to
get on this list after 2 years of working here. :)

Just thought I would share what I have come up with here at the Com Arts
Building with regards to making the local users administrators of their own
computers but not administrators of the network.

This can be done in a few ways.

First and probably the most common why is to just add the domain user to the
local Power Users group or the Administrators group on the local computer.
This will work fine but requires a visit or a remote connect to the local
computer.  If you already have a large network this method takes too long.

Second, you can make all workstations in an OU have local administrator
access regardless of the user.

Create an OU for the computers e.g.: Unrestricted Computers. Move the
computers you want to change into the OU. For the Unrestricted Computers OU
do the following. This must be done from the server.

1. Right click the Unrestricted Computers OU and select properties.
2. Go to the Group Policy Tab
3. Select or create a group policy and click Edit.
4. Go to Computer Configuration\ Windows Settings\ Security Settings\
Restricted groups
5. While restricted groups is highlighted select action from the MMS toolbar
and select "Add group"
6. Click the "Browse" button
7. Select the following group "Administrators" and click "OK"; this is the
built-in administrators for the domain controller, not the domain/tree
administrator.
8. Click "OK" Again
9. Double-click "Administrators"
10. In the "members of this group" and click the "ADD" button.
11. Select the browse button and select "Domain Users" and "users"
and "system" and "administrators" and "domain administrators" click "OK"
click "OK" Click OK. If you don’t have some of the groups or can’t find them
that is ok.
12. Now, from the command line type "secedit /refreshpolicy machine_policy"

The "Domain Users" that log onto the select machines will be local
administrators.

There is one more way to make it dependant on the computer and the user.
Basically it is the same but you also maintain a group with a list of users
and then only the users in the list that log into the unrestricted computers
will have admin access. Replace this group with the domain users group when
making the policy.

Hope this helps someone. If you have more questions email me and I will help
fill the gaps.

Nicholas Zeidler
Network Administrator
Communication Arts & Sciences
E: [log in to unmask]
P: (517) 353-7253