The administrators aren't admins on the computers that we connect to the domain so we have to login with a local admin and upgrade peoples accounts manually. How can we make the local accounts match the domain accounts?
-
Are you using Active Directory to store all your users on a dedicated server? or do you run local accounts on every machine and create local accounts for all users?– user95184Oct 31, 2011 at 22:24
-
@JoeSafe The AD has our users. When I (that is in the domain group administrators) log into a colleagues computer, I won't be an administrator but have to upgrade my account on that computer.– Kit SundeNov 1, 2011 at 5:16
-
OK, SORRY, just to check one more thing, you don't have any local accounts created with the same name on the names? So like your username on AD is Joe, you then don't have a local account called Joe as well on that machine do you?– user95184Nov 1, 2011 at 18:59
-
@JoeSafe No when I signed in with my AD account to the computer, it had never been used before.– Kit SundeNov 2, 2011 at 5:53
2 Answers
well anyone in the Domain Admins group should be administrator on the machines, it is pretty standard to have Domain Admins in the local Administrators group, but if you handle things differently, say with a "Workstation Admins" group, then you will need to create a GPO.
These two sites may help: http://myitforum.com/cs2/blogs/rdixon/archive/2008/06/17/how-to-add-domain-accounts-to-local-administrators-group-using-gpo.aspx
http://www.windowsecurity.com/articles/securing-local-administrators-group-every-desktop.html
Odd.. if you login to an AD domain-joined computer with an account in the Domain Admins group, you should have administrator rights on the machine. It takes a lot of extra work to make things not happens this way. Are you sure this isn't an elevation issue (ie: windows 7 will still require you to explicitly choose to run things as administrator now)?
Look in the local administrators group on the machine and make sure that {YourDomin}\Domain Admins
is a member.