user account with admin power

[semaja2.net]

Hey guys is it possible to make a user whom is part of the default user group when logged on to a pc has full administrator power of that pc

PS windows 2003 domain controller

[The Nonentity]

Hey guys is it possible to make a user whom is part of the default user group when logged on to a pc has full administrator power of that pc

PS windows 2003 domain controller

585122234[/snapback]

If I understood what you wrote, you are looking for an account that normally is restricted, gain administrative power on a specific PC?

As far as I know, that is impossible. Please drop a PM if you can find a solution.

[Mattimeo]

Make them part of the BUILTIN\Administrators group. THey will have local admins to the workstation that they log on as, but User rights to the network.

[semaja2.net]

thankyou mattimeo but in its description it says 'Administrators have complete and unrestricted access to the computer/domain'

[Aaron P]

If the user is added to the local Administrators group on a specific workstation, they will have administrative access to that workstation only.

Why do you want to give users local Admin rights? If this is to run an application that requires WRITE permissions to the registry and/or the local file system, you can give users the required permissions to those areas only without compromising the integrity of the workstation.

[TonyNZ]

^ yeah, just make him a local administrator, thats what i do on my network. Havent played around, but it might be possible via group polices?

[semaja2.net]

no these users own there own pcs and we dont want to resrict them from there own pcs

[Joel]

Hey guys is it possible to make a user whom is part of the default user group when logged on to a pc has full administrator power of that pc

PS windows 2003 domain controller

585122234[/snapback]

If the user is added to the local Administrators group on a specific workstation, they will have administrative access to that workstation only.

585126839[/snapback]

There's your answer.

[Simon Thulbourn]

If you make them a member of "BUILTIN\Adminstrators" you give them complete access to the local machine only, but this has risks since they could shutdown any other computer over the network remotely

i.e: shutdown -s -m \\Computer -t 00

I would create a new group and set permissions like an administrator, you will need to set something between Power User and Administrator.

[Aaron P]

What?? If I make a user a member of the local Administrators group (BUILTIN\Administrators) on one machine only, how do they possibly become an administrator of another machine where they are not a member of the local Administrators group?

[John Veteran]

Say you have machines WorkstationA and WorkstationB, and a server ServerC. Joe is a normal user in the domain and can log onto any computer he wants. To do what you want for Joe, add him to the WorkstationA\Administrators group.