1

At the company I work for, we have about 75 computer users. We have a Microsoft Domain Controller in our server environment (MS Server 2012) with Active Directory.

When users need to install software, they are prompted in Windows for an Administrative username and password. This means that they need to call me and I can login to their computer remotely (using TeamViewer) and I then enter my credentials so as to install the software.

I wan't to continue having control over what users can install however, to make things simple, I want to have a security group in AD where I can temporarily add a user to give them administrative access. This access needs to be local only. No RDP access to our servers is allowed!

I found a few examples online which explained how to do this and I followed the instructions. (Sorry, I don't have the links to these sites anymore). Basically, what I did is below:

I have created my group in Active Directory with a user added for testing purposes 'Temp Login'.

AD new group

...and I have created a GPO and I added my group added to the 'restricted users'.

enter image description here

When prompted for membership, I add 'Administrators'

enter image description here

Alright, so this method works almost exactly how I want. I can login to a laptop with TLogin (Temp Login account added earlier for testing purposes). And I can install software with no worries. There is however, only one problem.

I still have FULL access to use RDP for access to the servers!

How can I change my method so as to allow for LOCAL access only?

EEAA
  • 108,414
  • 18
  • 172
  • 242
pgunston
  • 311
  • 4
  • 6
  • 15
  • 1. Where have you linked this GPO? 2. Please clarify, you want to temporarily add some end-user to a local administrators group, so he can do the installation? and without allowing him RDP? 3. Another clarification, when you say "local" and "server", you mean "user's workstation" an "dc" respectively? – EliadTech Apr 27 '15 at 08:00
  • 1
    Sounds like that policy is applying to the servers as well - have you applied it at the top level? – Tom Apr 27 '15 at 18:49
  • 2
    If you haven't divided your server and workstation in different OUs yet, start it now. Then you link your GPOs to appropriate OUs based on your intention. – strongline Apr 28 '15 at 03:11

0 Answers0