[fodde]

I don't want any of my users to have any admin rights on their pc's. They install all kinds of rubbish which creates a support nightmare for me.

How can I remove my users from local admin rights with a GPO? Or, how do I setup a balance between limiting rights and being able to do basic secure functions on the local pc? Whith other words, what is the best solution to users' rights & permissions locally on their pc's?

Thanks

[JeremyW]

By default, domain users don't have admin rights on any computer. But if you need to reconfigure a bunch of computers where the users have been given local admin rights, you should look in to Restricted Groups.