Solved

Is there any built in group within AD for local administrator?

Posted on 2016-10-01
5
53 Views
Last Modified: 2016-10-19
Is there any built in group within AD that will grant the members local administrative permission on computers in the domain?

I will appreciate any guidance!
0
Comment
Question by:LuiLui77
  • 2
  • 2
5 Comments
 
LVL 18

Accepted Solution

by:
awawada earned 500 total points
ID: 41824835
Short answer no.

1. Create a Domain Group called for example "Local Admin"
2. add all users to this group that you want to grant as local administrators
3.  Use group policies to deploy this

Computer / Preferences / Control Panel / Local Users & Groups / Group – Administrator
Add your Domain Name\ the Group Local Admin

or

Look up the "Restricted Groups" Group Policy.
0
 
LVL 54

Expert Comment

by:McKnife
ID: 41824865
Short answer: yes! Of course the group domain administrators is by default member of the local administrator group of any domain member.

Whether it is sensible to use that group for client administration is another question.
1
 
LVL 18

Expert Comment

by:awawada
ID: 41824874
McKnife is correct there.

@LuiLui77
Do you really want to grant users as Domain Admins?
A Domain Admin is more than a local Administrator.
Windows Built-in Users and Default Groups http://ss64.com/nt/syntax-security_groups.html
0
 

Author Comment

by:LuiLui77
ID: 41826236
Is just local administration of the client machines, not to domain or servers
0
 
LVL 54

Expert Comment

by:McKnife
ID: 41826255
Then the approach as described by awawada should be used and the ´GPO should of course only be applied to an OU with client computers, not servers.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
This Micro Tutorial will teach you the basics of configuring your computer to improve its speed. It will also teach you how to disable programs that are running in the background simultaneously. This will be demonstrated using Windows 7 operating…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question