Need to make users local admins of their workstations SBS2008

Posted on 2011-03-03
Medium Priority
Last Modified: 2012-05-11
Hey there, We have an SBS2008 with 20 computers.  I cannot add users to the domain admins or administrators group on the server, or it will mess up their Blackberry sync.  I need to make the users able to install to their local machines, which means to me local admin rights.

On SBS2008 is there a way to allow this in GPO?

Thank you
Question by:bcameron70

Expert Comment

ID: 35031646
Open Control Panel Panel>>Administrator Tools (you may need to open this as the admin on the local machine)>> Under administrators ad domain users
LVL 13

Accepted Solution

connectex earned 2000 total points
ID: 35031979
While I'm a fan of the non-admin user. Here the proper way, SBS way of doing this task. In the SBS Console, click Users and Groups. On the users tab, double click the user name. It opens a new window. Click on computers. Highlight the computer and below pick the desired access level. Note that the rights will be progated by group policy as mentioned just below the access level drop down box.

Expert Comment

ID: 35032126
Create a custom GPO in your MyBussiness .. Computers .. SBSComputers using Group Policy Management (This would make sure that it changes only the workstations). Edit the policy you create and go to 'Computer Configuration' ..'Policies'.. 'Windows Settings'.. 'Restricted Groups' right click and select Add Group .. Type Administrators. Once created, double click the group and add the Domain Users group.

THis will add the Domain Users group to each computers local administrator's group. You can test it by typing GPupdate on a workstation and checking the group memeberships.
LVL 78

Expert Comment

by:Rob Williams
ID: 35050212
Restricted Groups in Group Policy is specifically for adding administrators to local machines. The following outlines the process, but be carefully using it. If you apply it to an OU that holds your admin account it it possible to lock your self out.
LVL 13

Expert Comment

ID: 35051343
I just want to point out my posting is how the SBS team designed the product to work. I know it's not the fastest method but it's guaranteed not to be overwritten by another method like setting up your own GPO.

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

You may have discovered the 'Compatibility View Settings' workaround for making your SBS 2008 Remote Web Workplace 'connect to a computer' section stops 'working around' after a Windows 10 client upgrade.  That can be fixed so it 'works around' agai…
Organisation is organized in a pattern to flow the day to day business, every application and system is interdepended on each other and when very important “Exchange Server downtime” happened.
The video provides a quick and easy steps to migrate MBOX file to well known Outlook PST and Office 365. Besides this, it also supports and migrates more than 20 email clients of MBOX which include AppleMail, Opera, Thunderbird and SeaMonkey effortl…
In this video I will demonstrate how to set up Nine, which I now consider the best alternative email app to Touchdown.

600 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question