Solved

How to add group to local administrators without removing the existing groups

Posted on 2014-12-18
4
173 Views
Last Modified: 2014-12-24
Hello everybody,

I'm in the computer migration process using ADMT.

The migration will take place between the Forest A to Forest B.

I'm having a big problem to include a group domain B (which will be the new domain that will receive the accounts of computers) in the Local Administrator group of computers that will be migrated.

I've tried to make the process with the GPO Restricted Groups using the option This group is a member of and users and other existing groups in the Local Administrator group is removed when the GPO is applied.

I've tried using the GPO Local Users and Groups in Computers\Preferences Control Panel Settings and when I add a group domain B Administrators from the group created in domain A the Administrators group is simply removed from the group.

I'm doing something wrong?

There is another way to solve this problem?
0
Comment
Question by:lucianolima
  • 2
4 Comments
 
LVL 17

Expert Comment

by:Emmanuel Adebayo
ID: 40506871
What level of authetication did you have between the two forest?

You will needd to Create a two-way, forest trust with forest-wide authentication.

regards
0
 
LVL 1

Author Comment

by:lucianolima
ID: 40506902
Hello Emmanuel,

I have Two-way trust with Forest-Wide Authentication.

Do you have any other ideas of what can be?
0
 

Expert Comment

by:Yusaf (Joe) Sneddon
ID: 40506911
Obviously if the trust is in place i would use a PowerShell script >> https://gallery.technet.microsoft.com/scriptcenter/Add-AD-UserGroup-to-Local-fe5e9239

Also the group policy preferences should work although never tried via that method across domains, so are you adding it under preferences and setting it to update the local administrators group? and its just removing it?
0
 
LVL 1

Accepted Solution

by:
lucianolima earned 0 total points
ID: 40509754
Hello everybody,

I solved the problem as follows:

I created a GPO and added a traditional .bat script in the Logon Script in User Configuration\Policies\Windows Settings\Scripts (Logon \ Logoff) the following command:

net localgroup "administrators" "domainname\domain admins" / add
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, I was asked to look into SCCM 2007 by my employer, having a degree of experience of earlier versions of SMS and some previous SCCM knowledge I didn't expect the procedure to involve to much time. I read a number of guides concerning it…
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now