📎 AI Summary:
The thread discusses the feasibility of assigning local admin rights in an Active Directory environment. The original poster wants to restrict admin access so that only the device owner has local admin rights, while maintaining centralized management and auditing, which is complex to implement. Respondents suggest that limiting group membership alone isn't sufficient, as it grants broad access across all PCs, and warn that giving users admin rights on individual devices is generally inadvisable, with no straightforward solution existing.
S

securitygeek

New Member
Joined
Jul 26, 2019
Messages
3
Thread Author #1
Hi,

Wonder if this is possible. Currently GPO is used to push out policy to allow an AD group local admin rights on PC's. The requirement is to further restrict access by using GPO (and possibly restricted groups) so that only the owner of the laptop has local admins to their PC. This needs to also allow centralised management and auditing. Is this even possible?

Thanks
 

Solution
Neemobeer
Oh you want to give the user admin rights? That is a really bad idea. There isn't an easy way to do that besides when the system is setup or some kind of scripted solution.
Sort by date Sort by votes
Neemobeer

Neemobeer

Windows Forum Team
Staff member
Joined
Jul 4, 2015
Messages
8,995
#2
Perhaps but that would be a bad idea to have only one account have admin rights on a system.
 

Upvote 0 Downvote
S

securitygeek

New Member
Joined
Jul 26, 2019
Messages
3
Thread Author #3
IT will have local admin rights also, but this is more from a user perspective. There's a separate group for IT.
 

Upvote 0 Downvote
S

securitygeek

New Member
Joined
Jul 26, 2019
Messages
3
Thread Author #5
Neemobeer said:
Just restrict who is in the administrators group
Click to expand...
Restricting the group is not the problem, the problem is once they are a member of the group they have local admin access to all PC's because group is assigned to all PC's. We need restrict it to specific PC's only.
 

Upvote 0 Downvote
Neemobeer

Neemobeer

Windows Forum Team
Staff member
Joined
Jul 4, 2015
Messages
8,995
#6
Oh you want to give the user admin rights? That is a really bad idea. There isn't an easy way to do that besides when the system is setup or some kind of scripted solution.
 

Upvote 1 Downvote
Solution
You must log in or register to reply here.