> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens
> Stefan G. Weichinger via samba
> Verzonden: woensdag 7 augustus 2019 13:53
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] best practice for domain admins
>
> Am 07.08.19 um 13:41 schrieb L.P.H. van Belle via samba:
> > Good one Norbert,
> >
> > And this is exacly as im doing my software installs.
> > My collega finds it very annoying. :-)
> >
> > I also added ( through GPO ) that, once your logged in the
> Domain, all software add/remove functions are disabled, even
> for Domain admins,
> > only "local - pc admins" can install software.
>
> This might get annoying if I deploy MS LAPS: separate admin-pw per PC.
>
> So I have to decide here ... (or roll out the same local-admin-pwd
> everywhere).
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
>
>
I understand why you saying that part about MS LAPS and im going to look into MS
Laps more.
For now, in this case, i suggest you setup 2 accounts.
One general ( LAPS compiant) and one only for software installs.
After you installed software on the computers, you disable the
"installAdmin" account and change the password.
The steps to the GPO's to create the local users and/groups.
1) Create a local admin group in AD
2) Add the needed users to the group
3) Create a new group policy to push the policy
4) Expand ?Computer Configuration? -> ?Policies? -> ?Windows Settings ?
-> ?Security Settings? -> ?Restricted Groups?
5) In the ?Add Groups? interface you add the group you created in steps 1 and 2
above
6) Attach this policy to the OU where the computer are.
And above means, you have to think carefully if you current AD-layout works for
you.
Per example.
BASE
OU=Domain controllers
OU=Computers
OU=users
Then you apply the GPO on BASE or OU=Computers ( depending on the GPO settings
also! )
Or
BASE
OU=Domain controllers
OU=Computers
OU=users
OU=Company
OU=Company,OU=Users
OU=Company,OU=Computers
Then you apply the GPO on OU=Company
Or
BASE
OU=Domain controllers
OU=Computers
OU=users
OU=Company
OU=Company,OU=Department1 ( containing its users AND computers )
OU=Company,OU=Department2 ( containing its users AND computers )
Then you apply the GPO on OU=Company
and per Deparment OU=Company,OU=Department1
or OU=Company,OU=Department1
But that depends all on you AD design.
So dont rush this, think carefully about it.
Greetz,
Louis