Problem: Users are always installing/uninstalling software to client machines – scanners, some want Firefox instead of explorer, etc.
So, I want to allowing domain users full administrative rights on client machine (ie. un/installing software, changing system time, etc). Presently since resources are tight, some users log on locally to DC for light work (internet research, etc), so I do not want them to be able to install software on DC.
One solution I found on the net was to go to each client machine’s security policies and add each domain users to the administrative list.
That sounds like a lot of work and it would be extremely difficult to manage once we expand, so I was looking for an easier way via AD and found this article but don’t know how to go about doing what it says (I’m stuck):