DLU and local "Administrator" account

Question

I have another network admin that has given me some information of the
subject heading that I don't quite understand...
They are using ZEN 3.2 with DLU on a Citrix server. This way, when a
student logs in via Citrix and gets logged in, ZEN policies restrict
them to what they can and cannot do on the local machine. Since they
need elevated rights to the registry (for whatever reason), they use
the "Administrator" account and are members of the "Administrator"
group on the local machine.
I simply don't understand it...When I use DLU (on workstations mind
you), I have the following for the policy...
================================================== =======
Enable DLU
Manage Existing User Account (if any)
Use eDirectory Credentials
Nothing underneath for the username, but they are members of "Users"
================================================== =======
His configuration is as follows...
================================================== =======
Enable DLU
Manage Existing User Account (if any)
Username: Administrator
Member of: Administrators, Users
================================================== =======
He tells me that with this config when a student logs in, they
automatically use the local "administrator" account. That's what I
don't get.
My config makes a new user on the workstation if they haven't logged
into the machine before. I thought at times it would be handy to make
3 accounts locally, such as "Staff" "Student" and "Administrator" for
instance, but didn't realize this config he talks about could make it
happen. Can it? I still don't get it at this point. I'm reading my
manuals and what-not and am not yet convinced.
What I'm hung up on is the password syncing. If I am logging in as
"bbinder" with a password of "hello" (NDS credentials) but the local
"administrator" password is "goodbye", why wouldn't it prompt me for
the administrator password since it's not the same as mine? There
isn't an "existing account" to manage in his config. This (I assume)
means it uses the account specified in the name field you can type in.
In his case, this is "administrator" as typed in above. But since the
passwords aren't the same, how does it use the local "administrator"
account? Does it overwrite the password? Does it create a new
administrator account and call it "administrator.001" ??? Not quite
getting it yet.
Anyone want to try and help me with this? Some people think there
would be some big benefits by having everyone use the local
"administrator" account, for instance because it has full rights to
the registry and file system. Plus, GP's will still be in effect, so
they would be locked out of the parts of the workstation you want to
lock them out of anyway.
Other advantages would include a "pre-made" user profile that has
already been secured and populated with the various things deemed
acceptable by the company's/school's policies.
Also, no delay on login when a new local account has to be created.
Since they are all using the same account being specified in the
policy, it would be nice and fast to login to.
Finally, no more prompting new users to enter in their names and
initials when MS Office apps run for the first time under a user
account. Maybe this could be avoided with a policy, but this would
suffice as well.
Sorry it's so long, but I appreciate any help you guys can offer to
clear this up for me.
Brian

Answer 1

Craig,
I'm sorry - I thought I replied on this post but I didn't.
Just wanted to say thanx for taking the time to explain this to me.
Brian
On Fri, 20 Aug 2004 10:46:44 GMT, Craig Wilson
<[email protected]> wrote:
>DLU simply changes the "Administrator" accounts password in this instance.
>
>How do you know what the current "Administrator's Password"? You don't
>and you just pray DLU or something does not break.
>
>Instead of using the "Administrator's Account", just use any other name of
>an account that does not exist like "SQUAREPANTS".
>
>DLU will create the account and put it in the administrators group.
>All users will share the same profile so you get all the benefeits of the
>other system, without the risk of losing access to the box.
>
>I actually never give user's local admin rights nor do I have user's share
>profiles, but .............