[bhavin78]

I need to remove domain users group from Administrators Group
and
need to all domain users to Power Users group on all PC's in the network (this included 2000, XP and Vista)

and
Change password administrator password on all PC's

What is the best way I can accomplish this (script or a Group Policy)?
Please let me know how?

[L4ndy]

You can use Restricted groups setting in gpo, This article goes through the process quite thoroughly:
http://www.windowsecurity.com/articl...ed-Groups.html

And for the password bit check this out:
http://articles.techrepublic.com.com...1-5198818.html

Hope it helps

[bhavin78]

If I add domain\domain user to members tab and Power User to members of Tab
and
domain admins to members Tab and Administrators to members of Tab

will the above configuration only deals with Administrators group of PC on domain or both PC and Servers?

[L4ndy]

Originally Posted by bhavin78

If I add domain\domain user to members tab and Power User to members of Tab
and
domain admins to members Tab and Administrators to members of Tab

will the above configuration only deals with Administrators group of PC on domain or both PC and Servers?

It depends whether you create a new GPO and apply those settings there in which case you need to make sure the Computer accounts are inside the GPO scope.
I wouldn't recommend editing the Default domain Policy nor the Default Domain Controller policy.
You may consider this as well:

net localgroup Administrators "Domain\Group" /Add

Copy this code, save it as a batch file and set it as the Startup script.

Unlike the restricted Group setting it doesn't remove the existing entries but just adds the new one.