I have some users on the network setup as Local Administrators and some as Power Users. Unfortunately, I have no choice but to grant Administrative rights to some users which use and install specific software (Quickbooks, MS SQL Server, Web developing software).
1. The users which have local Administrative rights have access to other people’s profiles (and computers) locally and on the network (ex: [URL=”file://\computernamec$”]\computernamec$[/URL]).
2. They also have access to Local Users and Groups in the Computer Mangement Console (they can reset the Administrator account password).
Those are the two major issues I’m facing at this time.
1. Restrict Local Administrators via GPO? How?
2. Make everyone a Power User and then give them rights to do the tasks they need via GPO? How?
Info: Win Server 2003 Ent SP2 (DC) and XP Pro SP3 (clients)