Adding domain group to the local Administrators group

Test it first!
You can add other groups or accounts as needed. Just don't leave Administrator and Domain admins out.
Here's an explanation of the restricted groups policy:

Restricted Groups
Computer Configuration\Windows Settings\Security Settings\Restricted Groups

Description
Restricted groups allow an administrator to define two properties for security-sensitive groups (that is, "restricted" groups).

The two properties are Members and Member Of. The Members list defines who should and should not belong to the restricted group. The Member Of list specifies which other groups the restricted group should belong to.

When a restricted Group Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list which is not currently a member of the restricted group is added.

 Note

The Restricted Groups folder is available only in Group Policy objects associated with domains, OUs, and sites. The Restricted Groups folder does not appear in the Local Computer Policy object.

If a Restricted Group is defined such that it has no members (that is, the Members list is empty), then all members of the group are removed when the policy is enforced on the system. If the Member Of list is empty no changes are made to any groups that the restricted group belongs to. In short, an empty Members list means the restricted group should have no members while an empty Member Of list means "don't care" what groups the restricted group belongs to.

Ivan hit this nail on the head!!  Nice work

Here is a good link too

http://www.computerperformance.co.uk/w2k3/gp/group_policy_security_restricted_group.htm
Security Settings  - Restricted Groups

Thanks
Mike

Very true!, but it can't be enforced.

Also simple mistakes with your approach may lead to huge security holes. Like allowing non privileged users write access to the script.

I tend to disagree with your statement (respectfully, of course). It asumes that a semi-proper change management process doesn't exist (I grant you that, in many environments it doesn't).  But if that were the case, then the small mistake in the policy or the script's permissions would be the lesser problem.

Restricted groups is very powerful.

This is simple. Just add the users to the built-in administrators group in Active Directory. They will not have access to domain information but will be administrators of the box that they log in to. Have the user logoff and back on to get their new group membership.

So - Can I get this right?

What is the best way to add a few groups and the local user to the local machine administrators group?

I agree with Ivan, Group policy with restricted groups is the way to go. Yes, the script is simple but it is full of security holes. Hackers and viruses love this type of "Lazy” administration................ If you’re going to do it, make sure you do it secure and do it right!

I agree that the script idea has holes; however another problem with the using restricted groups is that if the user is a member of the local admins group then when you do this he is kicked out. The only users/groups that will be in there are the ones you add in the GPO. Right?

I tried the above with a test OU and all local admin which were added to the machine prior to me placing a test machine in that OU were removed.  I was looking for a way to allow my desktop support members have admin access to workstations

Yes, that is the behavior of the restricted groups policy by design...
The only members of the group are the ones defined in the policy, no more and no less.

If you need to add members to the group but maintain the ones already in there, then restricted groups don't do that.  I don´t know if that changed in w2003r2, i don't think so.

It doesnt change in Server 2003 R2.  Once you add members to the restricted group and apply it only the members / groups you have added will be there.  The only other solution i can think of would be to use a logon script to set what one would need.