Re: Adding User ID in Local Admin Group using Group Policy

Sorry, I did not know this. I did lots of painful research about this and
finally performed the workaround I posted in this article for our
organization. Of course, this was prior to SP2 when this could only be
accomplished with the undesirable restricted groups/members and I never went
back and relooked at it.

Thanks!

"Roger Abell [MVP]" wrote:


"PC" <PC@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:D7101673-E4D9-4B30-84D3-E355DFC6CCE3@xxxxxxxxxxxxxxxx
This has been asked a million times and there is no clean solution, but
this
does work.

If you want to add and RESTRICT (unable to modify the membership locally)
of
the administrators group, use restricted groups. However, most people
don't
desire this behavior because it removes everyone else from the local
administrator's group.


Ummm - perhaps you should read the KB to which I provided a link
http://support.microsoft.com/kb/810076

Notice that, applied to case of this poster, one would define a
domain group, such as "ClientAdm", and then in a GPO with
the impacted client machines in its scope define a restricted
group definition for ClientAdm. In this restricted group definition
one would not (need to) use the Members list, but would add
Administrators to the Member-Of list.
The effect is that ClientAdm is added to the Administrators group
on machines in scope of the GPO, and no members already in
the Administrators group see any change (there remain members).

This solution became available with W2k Sp4 and Xp Sp2.

Roger


If you just want to add to the local administrators group and leave
existing
membership alone, use GP to run a computer startup script (NOT USER), and
only give domain computers access to the startup script file.

In computerstartupscript.cmd place:

net localgroup Administrators /add "domain\WKST Admin (SEC)". Please note
the limitation (undocumented bug) of 13-15 characters or so in group name
length for groups maniupulated using the net localgroup tool. Overwise it
will silently fail if the group name is too long even though it is valid
in
Windows. Use a short group name.

This global group will now be a local admin on all your machines on
reboot.
You can simply add desired users to the global group in Active Directory.

Another useful one -- reset the local admin password while you're at it,
but
be sure to restrict access to the login script to domain computers if you
do
this, otherwise it's not of much use!

net user administrator newlocaladminpasswordhere

"Ahmad M. Zahoory" wrote:

Hi,

We have ACtive Directory 2003 & also implemented the Group Policy.
We want to add one Specific User ID on all the workstation's Local Admin
(but not using the domain admin).
Pl. help us how we can implement this.

--
Regards,
Ahmad M. Zahoory

E-mail: ahmad.zahoory@xxxxxxxxx



.

Relevant Pages

  • Re: Adding User ID in Local Admin Group using Group Policy
    ... If you want to add and RESTRICT ... one would not use the Members list, ... The effect is that ClientAdm is added to the Administrators group ... Another useful one -- reset the local admin password while you're at it, ...
    (microsoft.public.windows.group_policy)
  • Re: Restricted groups local admins
    ... look at the Members of this group, both local admin and domain group are ... Administrators group has full rights. ... your Active Directory? ...
    (microsoft.public.windows.server.setup)
  • Re: Rid AD of Circular Group Membership
    ... and have use on members if it is used there. ... Administrators group is still intact), nor do they have empowerments over ... Admins is being used for by the 30+ can be delegated I(ex. ... The quess is each has an account and uses it, ...
    (microsoft.public.windows.group_policy)
  • Re: GAL View
    ... I don't want to restrict who can see the members of the group in GAL. ... I have a mail enabled group Group1, I have two users user1 and user2. ... Not an easy task. ...
    (microsoft.public.exchange.admin)
  • Local Administrators & Active Directory
    ... I'm working on some Win XP laptops and am new to Active Directory so ... I check the members list in Administrators... ... Any idea why the Administrators group members constantly are being ...
    (microsoft.public.windows.server.active_directory)