wouldn't it be nice....

[pborkstrom]

I've seen several posts hinting this particular task:

How to make group X a member of the local administrators group on workstations and member servers?

Delegating control to the help desk without adding them to the local admistrators group manually or without relying on login scripts would be a godsend to many of the netowrk admins I know!

[AdamV]

Please don't post the same question in three different places, and particularly not where it is off topic (this post is clearly not a submission for a Tip / FAQ, it is a question rather than an answer).

[pborkstrom]

Sorry about that. However, I wouldn't say that it's clearly not a submission for Tip/FAQ because the section is called "Submit a Tip for the Tips/FAQ". Thanks for your help - I think that your advice did pay off.

[romath]

Phil, if I read your post correctly, you're saying that the topic would make a good tip or faq.

Would you be willing to help me out with it?

Let me know!

Thanks

[pborkstrom]

romath,

I certainly would be interested in helping you out. I have 2 helpdesk persons that must be transitioned from Domain Admins to a group that has the ability to fully manage computers. Is there anything specifically you'd like me to help you with?

[romath]

I guess what I'm saying is, if you've implemented a solution, would you be willing to write it up and submit it to be posted in the tips/tricks/faq section.

[pborkstrom]

I'm not 100% sure if I have the idea sorted as of yet. I just implemented it yesterday afternoon (Chicago time). Once I'm confident that it does work, I can write up a solution along with the procedure to implement it.

[romath]

Excellent, let me know!

[Trammel]

If your going to remove them from the Domain Admins group why not add them to the Account Operators group? This group has full control over computer and user accounts within the domain. You will find it in the builtin folder in dsa.msc. While your in there you should see some others that may tickle your fancy. Print Operators is usualy a good choice for the Helpdesk people. That depends on your staff though

[AdamV]

Trammel, I think the point here was to give them total control over machines, but no control over accounts.