This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(0, 38%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIE%3C/text%3E%3C/svg%3E)
We have different applications installed on different Windows 2016 server, right now we have added the Application administrators to Local admin on the servers.
As per the security reasons we want those users to be restricted to change IPs, host file and other admin setting.
Can we create new Local GPO with less privileges on those servers and add the application administrators to those groups instead on local admin.?
Please note: Different application server has different app admin.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 44%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGR%3C/text%3E%3C/svg%3E)
You can create local GPOs as long as they dont overwrite domain GPs. Domain GPs are preferred by default.
If the GP is not defined by a domain GP you can define it locally.
Dear as I mentioned, we need to provide access such as Application owner can restart the services, can install applications. but shouldnt allow to change OS level settings.
We cant provide it on domain level since we have different users have to use different servers. So looking for a solution that should apply only on those servers.
You can't have user install Applications and not be Administrator. Thats just mostly not how this works.
While you can modify the ACL of services to give users or groups rights to restart them it still asks the question should you?
If you do not trust the users to change OS level settings then why do you trust them to install Applications? You are really looking at the wrong security measures here.
Either trust them or don't. You can increase security by for example only allowing Smart Card Login, WHfB or similar or deploy Zero Trust approches.