Admin user accounts

We have contractors installing PC's onsite and I want to them an admin account which will allow them to add pc's to our domain and local admin rights over those PC's for software installation. I don't however want that account to be able to login locally to any server.

Can I just create a domain admin account and deny local login on each server or is there a better route?

Thanks for you help.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Radhakrishnan RSenior Technical LeadCommented:

You can GPO's to achieve this. Refer the link for step by step

Hope this helps
Mohammed KhawajaManager - Infrastructure:  Information TechnologyCommented:
This is how you do it:

1.  Create accounts for contractors to be domain users members only
2.  Create OUs where these contractors will be creating PCs
3.  Delegate rights and grant these contractors ability to add computers to the domain
4.  Install AD Management tools for contractors
5.  Create GPO to add contractor accounts to local administrator group (this could be as simple as a computer policy to run a script containing:   net localgroup administrators domain\user-or-group /add
6.  Advise contractors to create computer account in the required OU prior first prior to joining computer to domain (by default non-domain admins can only add 5 or 10 computers to the domain unless they create the computer account first)
7.  Contractors join computers to domain and they have local admin privileges on computers

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
What are you doing in your environment and if you do deny local admin rights, how do you handle when you or the user has to install software? Must you logout and back in as the local admin

Just use the 'Run As" option, no need to log out and back in with an admin account

as for the other headaches . Proper patch management should take care of that. If fact I think giving them admin right creates more headaches, there is so much crap they could do I you will have no idea wear to start

Refer this link...

SandeshdubeySenior Server EngineerCommented:
I will recommend to process as this create normal heldesk user account in AD and add the same to local admin account of client computers.You can perfrom the same with restricted GPO.Ensure that restricted group policy is configured correctly else it will not only add required members to local Administratiors, but it will remove any members that were in local Admins previously.You need to select the bottom box under "This Group is a member of," so it won't wipe out current members on all machines.

To add the machine to domain delegate the control to add the machine to domain in AD to helpdesk id.

ensure that servers are in seperate OU and restricted GPO is not applied on server OU.So by default helpdesk user will not have acess to server.You can specifically deny logon to servers by adding the helpdesk id to deny logon locally and deny logon to terminal services.

Hope this helps.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.