allan m. grafil

Hi,

Need some help in GPO. i have a Windows 2003 Enterprise Server running as
Domain Controller. I our Active Directory users to have this policies.

1. Local user can install any application on their local PC.
2. Set restrictions on LAN Configuration, Desktop and other security
settings.

My current setting is each AD users are administrator on their local PC. So
restricting item 2 is quite impossible.

So how to work on this? I'm reading and browsing about Restricted Group in
GPO. Is this the answer tomy query? If it is how will I set this up?

Hope for your assistance.

Thank you,


Allan

meinolf weber [mvp-ds]

Hello Allan,

If your users are local admin they have full control over the local machine.
Remove them from the local admin group and consider to use GPO to install
software for the domain users/machines.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

allan m. grafil

Hi Meinolf,

Thank you for this. But can you give me specific info on this. i think i
have tried everything in GPO but I can't seem nto configure it correctly.
Here is what I'll do.

1. On local PC i'll make the AD users as Power Users.
2. In GPO set OU's (AD users resides) will have unrestricted software
installation.

PArt 1 is easy but part 2 where exactly this resides at GPO.

Your a big help. Thanks a lot.

Allan

meinolf weber [mvp-ds]

Hello Allan,

Why do you make them power users, any reason? Our users are domain users,
that's all. If they need additional software for working we deploy that with
softwaredistribution policy.

See here about software distribution:
http://technet.microsoft.com/en-us/l.../cc738858.aspx

http://technet.microsoft.com/en-us/l.../cc778924.aspx

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

allan m. grafil

hi Meinolf,

yeah your right on the domain users, just used that . I'll study the
links.

Thanks again

Allan