Possible to grant Local Administrative Access through Active Directory or Group Policy?

P.S.   The up side to this, is that you can set the domain user rights on the base image, so that no user accounts have to be set up at all on the machine - Once you image the machine, you can run Windows update, and deploy the machine.   It's REALLY easy, but I still don't recommend it.

creat  a batch file with following line and assign it to a "Computer Startup Script" in a Group Policy Object and give "authenticated users" or "Domain Users" read and apply permissions.

net localgroup administrators "Domainname\domain users" /add

that should do the trick.

I would suggest creating a group in AD and adding that group to the Admin List.  In the group you can add the users into it and then they would have Admin Access.

I am not sure of how your company is structured, but if you only want users in a department to have admin access to those computers then you simply assign their department group (which you can create) to the Local Admin list.  This way those users will have access to their computers and no one else will.

I believe that this can be done through AD, but I am not sure exactly where.  I will look this up and post once more.

Rob

Hi ulink

I completely agree with jigans's batch file proposal will do the trick, BUT..... If in future you want to revoke the policy, you will face problems, as even if you will remove the startup script for adding Domain Users to local administrators, the Domain users group which is already present in the local administrators group would remain. Microsoft has provided a simple Group Policy to accomplish this task.

Put all the workstations in one OU. Apply a group policy & configure restricted groups policy to it & that should do the trick, but make sure when you add Domain Users, never forget to add Domain Admins to local administrators as well, because when you apply this policy, it removes all other domain users & groups from the local group.

Here's an excellent article, that may help you out - http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

Feel free to post any questions or suggestions.

ADExpert

Access to install and uninstall programs and files is most strong on the workstation, you want to add the User to the local administrators group through AD under the computer account, you should be able to either 1 view the local users and groups policy from the computer account in AD or open MMC and remotely view the Local policies of the workstation via IP or Machine name, then add or remove people from groups.

To delete the domain users as local admin, you change the file to

net localgroup administrators "Domainname\domain users" /delete. or a particular usr name instead of domain users if you want to do for just a single one.

The group policy method is best - while the batch trick seems quick and easy, a short amount of reading will probably give you the understanding to accomplish it via a Group Policy. This is the sort of thing GPOs are for after all.

I too would suggest against adding domain user group to local administrators group, and would do as hauptra suggested and add specifically created domain groups instead.  EG Domain\local admins and Domain\local power (it is useful to add a domain group to the local power users group as well if you have some people you wish to grant power user levels of access rather than administrator level).  

That way it is easy to revoke a particular users rights, just by removing them from the domain group.  The batch file in startup script will work, as will restricted groups group policy setting for this.  The batch file can be reversed net localgroup administrators "Domainname\domain users" /delete
So that isn't really a major issue either.