GPO to add domain admin to local admin

tolinrome
tolinrome used Ask the Experts™
on
Is there a GPO that I can add the Domain Admins group to all the local admins group on all computers? DC's are 2008 and clients are XP and Win7. Thanks.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Consider implementing a GPO with Restricted Groups.
remmett70Network Manager

Commented:
Domain Admins by default get added to the local computer Admins group when a computer/server is added to the domain.  Has is been manually removed?
All Domain Admins are members of the local group.

You can verify this with the following command:

net localgroup Administrators
Success in ‘20 With a Profitable Pricing Strategy

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Brian PiercePhotographer
Awarded 2007
Top Expert 2008

Commented:
By Default Domain Admins are already local admins

Author

Commented:
I thought they did as well, but at least on one PC it's not. This is a problem since a user will be logged on then a Domain Admin comes by and cannot log them off and has to shut down the computer and log back in.
So how can I just create a GPO that will cover all that?
Network Manager
Commented:
Create a new GPO

Computer Configuration>Preferences>Control Panel Settings>Local Users and Groups

New>Local Group

Group Name:   Administrators (built-in)

Members: Add: yourdomain\domain admins

Under the Common tab check:  Apply once and do not reapply


link the policy to an OU that contains the computers to update
New GPO

Name: Restricted Groups

Computer Configuration -> Windows Settings -> Security Settings -> Restricted Groups -> Right-click Add Group -> Type Administrators (DO NOT Browse) -> click Add for members of this group and Click Add -> Browse for Domain Admins

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial