I need to re-work our current security model for desktop computers, and would like some insight as to what changes can be made as well as best practices.
Currently we have the helpdesk role that is published via GPO to add it to the local admins group on computers. For users that require to be local admins, we deny their computer access to the GPO and add their account to the local admins group. This poses a problem when our helpdesk staff needs to work on the computer when the local admin user is not present. Former admins (that is, no longer working here) placed the users in the helpdesk role that only needed local admin use on their computer.
We now have 30 power users that are now beginning to realize that they can access \computername\c$ shares.
How can I eliminate the helpdesk/local admin conflict without creating GPOs for every computer account?
Can I disable the local admin shares to a specific group and add our power users to that group or is that not a good policy?