Printable View
Is there a way to apply admin rights to a user but only on one computer? We have Active Directory and if you give local admin rights he can still go to another computer and use the rights there. Is there a way to make it computer specific...and maybe on the other computers just a power user or general user as put out by our GPO?
Or is this wishful thinking?
You can't just add them to the local aministrators group on that one computer? You could even do that remotely with a WMI script.
You can do it manually, or write a script or application to do it for you.
Group Policy will let you administer the administrators group, but the only way to do what you described would be to have a different policy for each computer...not a good idea at all.
if in AD you add them to the local admins group and they move from one computer to another they are an admin on the other machine as well. I want to limit what certain people are doing on other machines on the network. They need to be connected to the network to get information and other such things. But what they have begun doing is installing stuff on PC's that shouldn't be installed. Am trying to stop them. My boss doesn't want to put them on their own little network. So I figure maybe there was a tool out there that would be able to group them by their mac addy and restrict them that way.
There may be something, but I haven't seen it. If you manage your computer through group policy restricted groups (and it sounds like you do) create an exception group in your AD for that policy. Set the group policy security to deny application to all members of that group, then put these exception computers in that group. You'll still have to manually add the rights on those systems, but it's better than giving him rights to everything.
I'm pretty sure that's not he way it works, it works that way if they are a domain or global admin group but a local admin is only and admin on that one computer (or ones that use the same image). At my work almost all of the computers are in AD and I'm a local admin on some and not others. Maybe we are having a terminology mix-upQuote:
Originally posted here by earthbound4u
if in AD you add them to the local admins group and they move from one computer to another they are an admin on the other machine as well. I want to limit what certain people are doing on other machines on the network. They need to be connected to the network to get information and other such things. But what they have begun doing is installing stuff on PC's that shouldn't be installed. Am trying to stop them. My boss doesn't want to put them on their own little network. So I figure maybe there was a tool out there that would be able to group them by their mac addy and restrict them that way.
Heere is a command you can use from the command line to set up the user on that one computer. Go to that one computer, drop out to the command prompt and type:
net localgroup administrators WhateverUserNamei /add
well see...I am not in the domain admin's group I am only a local admin and I also can walk from computer to computer to do what I want. Granted every little thing I do is being tracked. But I still would like to stop things from happening b4 they start. Maybe they have it set up wrong. I don' tknow.
Grouping them by their MAC addresses isn't a reliable way of doing it, as a MAC address can be easily spoofed.
You say you have local admin rights...on the server???
That would add you to the local administrators account on the WS connected to the domain as a domain admin.
I have a site 2003 server...default policies are as follows....I tweak as needed
All users are added to the domainusers group when created and that group is added to the users group of the workstations when they join the domain...very basic rights. Domain administrators are added to the workstations administrator group. If I want to accelerate the users permissions on the workstation you have to add them to the workstations administrator group...or if you want the user to have administrative accounts on ALL workstations...add them to the domain administrators account....which in turn will add them to the the all the workstations administrator group
So if this user is administrator on all workstations...someone has deviated from the default AD setup...and added them either to a global domain account (domain admin) or added them to each workstations admin account.
Clear as mud :eek7:
MLF
Excellent point, I was assuming we were talking about group policy, but that may not be the case.
What OS, specifically are we working with? Can the user be added to the administrators group on the local workstation, or is something preventing that?
If i might I'd like to clarify some things here that seem to be "fuzzying" this whole conversation.
Definitions:-
1. Domain Administrator: A domain admin is an administrator of a Windows AD domain. He may administer all things in the domain, (except two but we'll forget those for this discussion). While a domain administrator cannot be removed form their ability to admin the domain through AD Users & Computers etc. They most certainly can be restricted from admin privs on individual works stations etc.
2. Local Administrator: This chap is the admin of a workstation or server, (except an AD controller that have no users or admins). He has no control over any domain functions and I don't even believe that a local admin of a workstation could be added to the domain admins group in AD - though I'm sure someone has a nice little hack for that one if you have admin acess to a DC.
The user groups are similar. A user on a workstation can't be a user in a domain. A user has to be added to AD as a domain user and log into the domain to have privs there. They will, at a minimum be a user of the workstation if they successfully authenticate to the domain. A domain user can be added to the local admin group of any specific workstation or non AD server by going to the Users section in control panel or under My Computer - Manage and added to the Admin group by selecting the domain as the source of the list of users and selecting the appropriate user from that list.
In short there is a huge difference between "Local" and "Domain". They are utterly different and there is no "Local Users" or "Local Administrators" group in any AD install I ever came across.
So.... having said that....
Earthbound.. What is the problem, precisely?
You are saying that you aren't a domain admin but you seem to be saying that you are adding users to groups in AD.... You can't.... Are you _sure_ you don't mean you are doing it on a workstation and adding them to the Administrators group there?
You also say you aren't a domain admin but that you can go to any computer and do what you want.... that leaves two scenarios possible:-
1. Your domain admins have either domain users or authenticated users added to the local administrators group of each workstation - That would be considered bad....
2. You are a domain admin and don't know it since domain admins are added to the local admin group of any workstation that joins a domain by default - again, this is bad.
Another possibility:-
Are you sure that you have not been delegated authority over an OU, (Organizational Unit)? This would grant you local admin privs without you being a domain admin.....
So.... If you want to give a user admin privs on a workstation then go ahead and do it through control panel or My Computer - Manage, (if you can), and don't do it to any other workstation and you will be fine.....
But my best piece of advice to you at this point is to do two things:-
1. Learn the differences between domain and local, AD and Users and how they apply in an AD environment
2. Go and ask your domain admin what rights you have, _exactly_ and how they are derived, (through AD, therefore a domain admin, (albeit a very limited one), or through AD as a delegation or simply because they ran a script on certain computers to make you a local admin.
Hope that clarifies the terminology and the differences.
I was never talking about servers just the work stations in general. Here they have overlapping policies which I guess one outdoes another. It is set up that if you are a local admin then you can go to any workstation and basically do your thing to a point.... the Domain admins have been set up to be the only ones (they think) that can touch the servers. I am hoping they are right. I haven't played with them yet. But I think from playing with AD this morning that I have figured out what is going on...But let me ask this....Can one GPO kind of cross out another going with the example above. I assigned a user local admin rights thru AD just on that machine. (Everyone is part of the Domain Users group.) But it was previously assigned to him that he would have power user rights on the other machines. Could it by chance propagate (that the right word?) to the other machines or get it mixed up with the other settings?
I think I am mixing myself up.
How did you assign the user rights to only that one workstations through AD? Based on your last question, it looks like your using a set of group policies...the rest of my response will proceed on that assumption. ;)
If you're using group policy, yes policies can override one another. Group Policy is set up so "last policy applied wins." If you have 5 policies trying to apply different members of the administrator group, that last on evaluated will be the one that wins. This is usually the policy that is "closest" to the computer object. For more information on that, go here:
http://www.microsoft.com/resources/d...c_pol_DYZR.asp
What operating system is on the workstations? Your best bet may be to use some of Microsoft's resultant set of policy tools to figure out what's going on.
Not only that... I think you are mixing me up too..... ;)Quote:
I think I am mixing myself up.
Yes, a GPO can override another GPO. In fact one GPO can completely reverse another. I'm still having a hard time working out exactly what is going on there.
How were you "playing with AD"? Are you adding and changing user properties? If you are then you are either a Domain Admin or you have been delegated power over your OU.
---------------------------------------------------Quote:
Originally posted here by Timmy77
How did you assign the user rights to only that one workstations through AD? Based on your last question, it looks like your using a set of group policies...the rest of my response will proceed on that assumption. ;)
Right clicked on the computer name and added him in as local admin just for that machine. I also checked his account to make sure that it showed up as such and it supplied the Domain name and his permissions to that computer.
---------------------------------------------------
XP SP1Quote:
Methinks you have more power there than you think.....
I actually had him put in a test area that I have access to. I don't have other access to the entire Directory. But he has been a problem. He knows a lot and my peers want him fired. But he really has done nothing other than just be annoying to the HD staff....He wants things that aren't allowed...on his computer...and keeps trying to put them on. We have made it so that even if he DL's some of the stuff he still can't run it like AIM, Kazaa, limewire, Yahoo IM, Napster, and a few bit torrent stuff. But he gets around it. It isn't like I can't see him doing that stuff. We have alot of stuff monitoring the comings and goings of the traffic around here.Quote:
Originally posted here by Tiger Shark
Not only that... I think you are mixing me up too..... ;)
How were you "playing with AD"? Are you adding and changing user properties? If you are then you are either a Domain Admin or you have been delegated power over your OU.
Oh and his latest exploit was something called Miranda (i think that is right) an instant messeger that can run off removable media or something like that.
http://www.miranda-im.org/
The higher ups don't think it is that much of an issue. But when a security breach comes around I am ready to say "I told you so".
But that is a different matter.
I seriously think I have been brought on to give ideas rather then follow through with them. Everything I have asked done they won't do or "they will consider." They already had an internal breach...anyway. I am ranting I apologize.
I mean I am by no means a expert at anything but there is common sense to be used. And I am learning. Google is my friend. Kind of.
I don't suppose you have a policy do you?
If so then you tell the higher ups that the policy must be applied evenly across all staff or when they _need_ to use it there is a possibility that a lawsuit will ensue where it will be proven that the policy is not equally applied to all..... In that situation your company loses.... to the tune of hundreds of thousands of dollars in restitution to the fired employee.... Then see what they say.
Quote:
Originally posted here by Tiger Shark
I don't suppose you have a policy do you?
If so then you tell the higher ups that the policy must be applied evenly across all staff or when they _need_ to use it there is a possibility that a lawsuit will ensue where it will be proven that the policy is not equally applied to all..... In that situation your company loses.... to the tune of hundreds of thousands of dollars in restitution to the fired employee.... Then see what they say.
You know what is funny...they do have policies even for complex passwords and other such stuff...and you know it was all signed and dated long before and I am talking months to over a year (depending on the policy) before I got here. (I came on in January)
Try it then....
Point out that if they can't use the policy in this situation on a user who blatantly does everything he can to breach or circumvent the policy then it isn't worth the cost of the paper it is written on and can never be used in the future because the person you use it on may be aware of this particular user's abuse of it.
I would like to say yes to that....but from my vantage point I should say no I don't know what you are talking about.Quote:
I will say in somethings yes I do have more power :) ....but not this instance. It would depend on the department I am working with
Quote:
Originally posted here by Tiger Shark
Try it then....
Point out that if they can't use the policy in this situation on a user who blatantly does everything he can to breach or circumvent the policy then it isn't worth the cost of the paper it is written on and can never be used in the future because the person you use it on may be aware of this particular user's abuse of it.
What I am actually trying to get that department to do is hire someone else ot work wiht him....and take over a portion of the project he is on...filter out a couple of his steps learn more of the i guess you would call it trade or whatever....and maybe get him fired. He knows they won't do anything to him right now...he is kind of a key piece to a contract we have. Dunno...they need more of a checks and balances kind of thing where not one person but a bunch of people work on the important aspects of things. what is it called a rotation of duties? separtion of duties?
Anyway. This has become a rant. I will take a look at what you guys have said and see if one GPO is circumventing another. And go from there.
THank you all very much for your help.
Place him in a separate OU. Create a GPO and check the No Overide box... Then lock him down as you wish. That will prevent other policies from conflicting.