?
Solved

Can't properly add local admins with Group Policy

Posted on 2011-03-03
4
Medium Priority
?
470 Views
Last Modified: 2012-05-11
Hi there

I'm trying to give a handful of users Local Admin rights on all machines at an office.  I have created a group on the server (Server 2003 R2) and added a few members to it.  I created a GPO and set up Restricted Groups...  i configured the Administrator group and added the group I created earlier.

Now when I log onto a workstation (XP or Windows 764 bit) , I go to view the users and my group is not listed.  I then go to the Advanced tab, click on the Advanced button and when I go to Groups and Select Administrators, the group I created IS a member.

However when I log on to the machine as one of the members of that group, they still do not have Local Admin rights.

Any suggestions would be appreciated.

Thanks
0
Comment
Question by:stormstar
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 79

Accepted Solution

by:
arnold earned 1000 total points
ID: 35027788
Using the route you seem to have gone, this will mean that the GPO will clear the existing Builtin\Administrators group and will add the user you list.

Double check the entry, the other option using restricted groups is to use the
domain\group is a member of builtin\Administrators group.
This will append the group into the local administrators group.

Double check where this GPO applies and whether there is another GPO that superceeds it.

There might be an exclusionary rule where the group members are members of another group which is restricted from having local admin rights.

use GPMC to get the group policy results and see what affects the rights of group members on a specific system.
0
 
LVL 12

Assisted Solution

by:Dave
Dave earned 1000 total points
ID: 35039490
Not sure why you expect your group to be listed on the workstation. It needs to be an active directory group, and the workstation only shows local groups.

 It can't be a local group becuase the GPO contains the SID/GUID of the group not the name. When you define local groups on multiple workstations they all have unique SIDs even if they have the same name.

Note that groups like the local administrators groups all have the same SID on all workstations.
See:-

http://support.microsoft.com/kb/243330

for a list.

If your group is listed in the local administrators group, then users have administrator rights on the workstation, but if user account control is on on Windows/7 the token will be stripped. How do you know the users don't have admin rights?
0
 

Author Comment

by:stormstar
ID: 35041352
Thanks for the info guys.  I actually ended up taking a different route that suited this environment better.

Both of you made very good points so I am splitting the points between you both.

Thanks
0
 

Author Closing Comment

by:stormstar
ID: 35041358
Both comments were accurate etc, but I was not able to continue through with testing as a better\alternate method was found.
0

Featured Post

Free Backup Tool for VMware and Hyper-V

Restore full virtual machine or individual guest files from 19 common file systems directly from the backup file. Schedule VM backups with PowerShell scripts. Set desired time, lean back and let the script to notify you via email upon completion.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
Citrix XenApp, Internet Explorer 11 set to Enterprise Mode and using central hosted sites.xml file.
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question