Local Admin is the exception, and generally only occurs for political reasons. Apps which "require" local admin get run through FileMon and RegMon to tear down minimum rights, and GPOs set any required permissions based on group membership.
From: David Lum [mailto:[EMAIL PROTECTED] Sent: Wednesday, August 27, 2008 7:15 AM To: NT System Admin Issues Subject: Local admins? Do most people here have their users set *not* to be local administrators on their PC's? We have 250 users here all as local admins and we'd like to move them away from that. BeyondTrust has a privilege Manager which lets you very granularly set permissions for the items you want to allow higher access for, I'm wondering of most folks can move users off of being a local admin w/out a tool like that? Dave Lum - Systems Engineer 971-222-1025 Northwest Evaluation Association - www.nwea.org ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
