Is this possible with GPO? If so, How??

at company adding child domain segment of our network host our retail pos systems.  our corporate domain mycompany.com, adding retail.mycompany.com.  because retail domain spread out on 300+ locations across 2 states, have need "lock these machines down". 

when store employee logs on 1 of these machines want them see type of environment.  things like:  no bitmap wallpaper, default windows blue background, restricted start menu, no run command, classic shell, classic start menu, limited access in windows explorer..etc..  have part working (so far).

when store has problems, call our support line , our support team can remote location , troubleshoot problems.  guess 8 out of 10 times standard store employee account (a standard user account)  have privileges necessary perform support duty (e.g. ctrl+alt+del , kill process, run 3rd party app clears out log files..etc) - 

the other 2 times, tech support team need ability start / stop service or add / delete printer / install new software, perform tasks require elevated level of privilege. 

because of compliance issues (and best practice), cannot have shared user account / passwords segment of network.  solution set parent-child domain structure.  there group on parent domain added group on child domain placed in local admin group on our pos systems (via restricted groups).  

my question - how can use gpo modify "locked down" environment when in support group logs on pos?  admin user not exist in child domain, exists in parent domain.  in addition, when admin user logs in, select mycompany domain, not retail domain.  possible?

at first thinking if created "user" gpo on retail domain, , scoped members of support group, apply.  realized logging on parent domain.  want create gpo apply when user support group logs on pos system in retail domain.  don't want force environment when admin user logs on own workstation.

 

is possible, in advance direction.  sorry long post, wanted give background.

 

sb

 

no, you're correct. best practice admins have regular account used when logging own workstation , elevated permission account used admin functions. perhaps time introduce latter.

 

if that's not option, can use wmi filter on gpo check domain membership (or other wmi exposed property). filter like ("select * win32_computersystem domain = 'name'").

 

thanks,

guy

Windows Server  >  Group Policy