Group Policy to join Domain_User to Local Administrator Gruop

Hello All,

i have more have 250 windows machines in our environment. All Domain_Users were used to login to their respective workstation (they doesn't have any admin rights on local machine).

now i got instructions from my manager to add every Domain_User to their local machine Administrator Group (only particular user who is using that machine that machine not all users).

i can able to create a GPO to add Domain_Users Group to local machine administrator group but, i don't know how to add only (specific) users who are logging in to that machine using GPO.

can any body help me out.

Thanks,
Rafi
hellosoftAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

vaporvicCommented:
Startup script linked to GPO is the best option. This one should do the trick.

http://gallery.technet.microsoft.com/scriptcenter/aa9c2662-1861-4b93-9030-176844037bc7

hth

vic
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
hellosoftAuthor Commented:
Thanks Vic,

script looks very impressive.

Thanks,
R
0
vaporvicCommented:
good deal. if it works out for you please mark it as the solution.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

hellosoftAuthor Commented:
Sue Vic,

i have a doubt in this script. from the below line do i need to all add computer name (WINXP01) and username (User1) manually.

Case "WINXP01"
        objGroup.Add "WinNT://"& DomainName &"/User1" &"" 

Thanks,
R
0
vaporvicCommented:
yes, the script looks for the computer name match. tedious, but less tedious than logging onto 250 machines. ;-)
0
ChiefITCommented:
Please forewarn your boss, what you are doing is very dangerous to IT security. The user shouldn't have admin rights to a computer because then the user can make administrative edits to the computer's settings. This means, if the user downloads malware, the malicious ware can have its way with the user and computer, and potentially end up a domain problem.

If I were you, I would grant explicit rights for explicit functions using group policy. Then, if they need the ability to logon locally as a domain user without a connection, allow cached logons. I wouldn't take it further than that.

Personal information and trade secrets are lost this way.
0
hellosoftAuthor Commented:
Hello Vic,

Could you please tell me which are variables in the above script you given.
i am unable to using below script

on error resume next
 
Dim DomainName
 
Set net = WScript.CreateObject("WScript.Network")
 
ComputerName = net.ComputerName
DomainName = "rafi.local"
 
 
set objGroup = GetObject("WinNT://"& ComputerName &"/Administrators")
 
SELECT Case ComputerName
 
    Case "Client"
        objGroup.Add "WinNT://"& DomainName &"/hb.User1" &"" 
 
 
End Select
0
vaporvicCommented:
to ChiefIT: I would assume that he has been directed to do this by his boss.

to HelloSoft: It's not my script, I just found one that should work for you. Go the original link. Everything in read is a variable.
0
hellosoftAuthor Commented:
Thanks Vic
0
vaporvicCommented:
everything in red is a variable.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.