Tips for setting up Windows domain accounts

I am running a network of hundreds of computers with Windows XP Pro clients and Windows 2000 Server for a domain. I would like to set up a network administrator account to be able to install software on local client machines. Is there a way to do this so that I can just log on using an admin account I create on the domain and be able to install the software?

You can grant local administrator privileges to a domain account by adding that domain account to the administrators group on the local machine. Creating a group in the domain containing the domain accounts that are allowed to administer machines, and adding that domain group name to the local administrators group on each machine, let you change the local administrators group on every machine simply by updating the one domain-security group entry. You will need to install the Adminpak.MSI package, available on your server CD or from Microsoft, on your workstation if you have not already done so. Use the Active Directory Users and Computers application found under Administrative Tools in the control panel to create a new universal security group and add your trusted-administrator accounts to the group. Add this group to the local admin group on machines as you roll them out or as you perform maintenance. Once the local admin group contains the domain admin group, domain admins can perform local administrative tasks.

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

I am running a network of hundreds of computers with Windows XP Pro clients and Windows 2000 Server for a domain. I would like to set up a network administrator account to be able to install software on local client machines. Is there a way to do this so that I can just log on using an admin account I create on the domain and be able to install the software?

You can grant local administrator privileges to a domain account by adding that domain account to the administrators group on the local machine. Creating a group in the domain containing the domain accounts that are allowed to administer machines, and adding that domain group name to the local administrators group on each machine, let you change the local administrators group on every machine simply by updating the one domain-security group entry. You will need to install the Adminpak.MSI package, available on your server CD or from Microsoft, on your workstation if you have not already done so. Use the Active Directory Users and Computers application found under Administrative Tools in the control panel to create a new universal security group and add your trusted-administrator accounts to the group. Add this group to the local admin group on machines as you roll them out or as you perform maintenance. Once the local admin group contains the domain admin group, domain admins can perform local administrative tasks.

Read more about software in Network World's Software section.