User Error

This is a brain dump of something Alan Burchill and Lilia Gutnik presented at TechEd Australia 2009. It covers managing local administrators on your workstations using the power of Group Policy Preferences.

1. Create a new GPO if necessary, link it to the OU where it needs to be applied
2. Edit the new GPO, and go to Computer Configuration, Preferences, Control Panel Settings, Local Users and Groups
   
3. Right-click in the pane on the right, and select New, Local Group
4. Set up the “New Local Group” as per below. I’ve got it removing all existing users and groups so that we can define everything we need using Group Policy. You add variables like %computername% by pressing F3 whilst the cursor is in a text entry field.
    
   I also included the Description text that is shown on the default local Administrators group; "Administrators have complete and unrestricted access to the computer/domain”
    
5. You also need to add a member called “domainname\%ComputerName%-Admins”. This will allow you to define a group in AD that can be used to assign local admin rights to a particular machine.

   The good thing about this is that you only need to define groups for PCs that you wish to add local admins to, but all PCs that have the GPO applied are ready for this type of setup.
   

6. You can also go into the Common tab and select “Remove this item when it is no longer applied”
   
7. The last step is to create a Security Group in AD with the name {computername}-Admins. For example, if you have a computer named syd-60128, you create a group in AD called syd-60128-Admins. Adding users into that group will then make those users a local administrator for that particular PC.
8. Do a “gpupdate” on the machine in question, and you should see the group’s membership change:
   

I’ve been sitting on this post for a long time, and intended to write a more detailed description.

Here are some things you may need to consider (outside of the obvious like DHCP scopes, DNS server settings, Firewall settings & rules, etc) when changing the IP range your Windows network operates on:

• TCP/IP Printer ports on print server
• Printer/Copier IP/DNS/SMTP settings
• Exchange allowed relay ranges
• Any copy/print accounting devices attached to copiers
• Monitoring host settings. Eg. Big Brother/Hobbit – Both client and server side, if not configured to use DNS in config files
• Server iLO IP addresses

Some steps for changing domain controller IP addresses. Do these first before any other important servers:

1. Change IP
2. ipconfig /flushdns
3. ipconfig /registerdns
4. Either restart the Netlogon service, or run ‘nltest /dsregdns’
5. Reboot

Disclaimer: This is by no means a complete list. Use these directions at your own risk.