Use group policy to grant local computer admin privilege

you can add that group on each pc, but if you put the computers in the new group in the container,and define the logon locally property, you don't have to go to each pc. - Travis

Hello,

   Guru is correct on this one, after following his steps just run gpupdate from the command line and you're done.

essaydave -

When I use the control panel / user accounts tool on the local PC, it seems like I can only add domain users and not groups - that is, I can only select user object types.  How do I add a group defined in active directory on the domain controller to the local computer Adminstrator security group ?

Gurutc -
It's not obvious to me which domain controller group policy security setting will give the new security group (defined in the new container) local administrator rights

Once you create the new container in the AD, you can right click on it, go to properties, and there will be a group policy tab just like the domain has.  Any pc's in a group in this container can have their 'logon locally' property set by the group policy of this container.

Good Luck,
Travis

Also, if you're going to go ahead and add the domain group to the local admins group on each pc, if you have trouble browsing the domain group to add it, instead type domainname\groupname where domainname is your domain and groupname is the group you're adding.  It'll help if you're logged into the domain on the machine while you're adding the group.

Regards,
Travis

Sorry about being unclear on that one Rock, but yeah, you want to manually enter in the groupname.  You should be able to script it up easily too, to save you the hassle of running around between computers.  (I'll see if I can start one off for you)

As far as I know, Group Policy can allow "Logon Locally", but cannot change security permissions, so will not be able to add the group to the local administrators.  Is there a policy that will do this?

Here's how the new container does the security stuff:  First, set the group policy on the container for 'no override' to take care of any pesky local security policy edits.  Then in Active Directory Users and Computers console, click 'View' on the top bar.  Make sure 'Advanced Features' is checked.  Then right click on the new container that has your new group in it that has the computers in question as members.  Choose 'Properties' then click the 'Security' tab.  Now you can set permissions on any objects in the container including the group that holds the computers.  This will override local policies on the PCs.

Good Luck,
Travis

Well, that turned out pretty easy.  The script is between the lines, what you need to do is create a text file with the computers you want modified each on a seperate line.  Then change the file path in the script, change "domainname" to your domain name, and change "groupname" to the group you want to add.  Save the file with a .vbs extension, run the script and you're gravy.  Thanks go to the Scripting guy, I just added the textfile bit:

http://www.microsoft.com/technet/scriptcenter/resources/qanda/sept05/hey0923.mspx

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Const ForReading = 1

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextFile = objFSO.OpenTextFile("c:\dave\scripts\NEW\computers.txt", ForReading)

Do Until objTextFile.AtEndOfStream
    strNextLine = objTextFile.Readline
    Set objAdmins = GetObject("WinNT://" & strNextLine & "/Administrators")  
    Set objGroup = GetObject("WinNT://domainname/groupname")
    objAdmins.Add(objGroup.ADsPath)
Loop

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Hope that helps