Solved

Is there any built in group within AD for local administrator?

Posted on 2016-10-01
5
47 Views
Last Modified: 2016-10-19
Is there any built in group within AD that will grant the members local administrative permission on computers in the domain?

I will appreciate any guidance!
0
Comment
Question by:LuiLui77
  • 2
  • 2
5 Comments
 
LVL 18

Accepted Solution

by:
awawada earned 500 total points
ID: 41824835
Short answer no.

1. Create a Domain Group called for example "Local Admin"
2. add all users to this group that you want to grant as local administrators
3.  Use group policies to deploy this

Computer / Preferences / Control Panel / Local Users & Groups / Group – Administrator
Add your Domain Name\ the Group Local Admin

or

Look up the "Restricted Groups" Group Policy.
0
 
LVL 53

Expert Comment

by:McKnife
ID: 41824865
Short answer: yes! Of course the group domain administrators is by default member of the local administrator group of any domain member.

Whether it is sensible to use that group for client administration is another question.
1
 
LVL 18

Expert Comment

by:awawada
ID: 41824874
McKnife is correct there.

@LuiLui77
Do you really want to grant users as Domain Admins?
A Domain Admin is more than a local Administrator.
Windows Built-in Users and Default Groups http://ss64.com/nt/syntax-security_groups.html
0
 

Author Comment

by:LuiLui77
ID: 41826236
Is just local administration of the client machines, not to domain or servers
0
 
LVL 53

Expert Comment

by:McKnife
ID: 41826255
Then the approach as described by awawada should be used and the ´GPO should of course only be applied to an OU with client computers, not servers.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum editing capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now