Give local admin rights to user on domain computers

My company is currently using a server with Windows Server 2008 SBS. I have always been the person that has managed IT for the entire company. Due to growth, we are adding a part time tech to help with smaller issues. I need him to have local admin rights on most of the domain connected computers. He is not going to have access to managements computers or the servers though. What is the best way to accomplish this?
Robcarter10Asked:
Who is Participating?
 
Dariusz TykaConnect With a Mentor ICT Infrastructure Specialist Senior Commented:
I would use restricted groups for that or group policy preferences. Using both methods you can add his account (or even better a group he is member of) to local administrators group on domain computers.
http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/
1
 
Jeremy WeisingerSenior Network Consultant / EngineerCommented:
Use the SBS console to assign the user to the computers.
https://technet.microsoft.com/en-us/library/cc527565%28v=ws.11%29.aspx?f=255&MSPPError=-2147217396

Or restricted groups if you're planning on getting rid of the SBS server (which you should probably). :)
0
 
AlanConsultantCommented:
I agree with using Restricted Groups for this (should work on SBS too - not sure why it wouldn't Jeremy?)

I would create a Security Group, probably for now with only the new IT Tech in it, then deploy that group to all machines that you want them to have full admin access to using a Restricted Group GPO, and put the group in the local machine's Administrators group.

To make it easy to manage, I would have a separate OU for the user machines that they can access (probably a new sub-OU under the existing one) and put the user machines that they are allowed to manage in that new OU, then target the GPO to machines in that OU.


Alan.
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
Jeremy WeisingerSenior Network Consultant / EngineerCommented:
I agree with using Restricted Groups for this (should work on SBS too - not sure why it wouldn't Jeremy?)
Oh it definitely would but with SBS you can assign the user as an admin to all the computers in just a few clicks.

Also, since it's SBS, I wouldn't mess with the OU structure unless you don't want to use the SBS console. There are some things you can do with it but generally, you should just use the SBS console to administer an SBS server.
0
 
AlanConsultantCommented:
Hi Jeremy,

I see - totally agree about using the console / wizards with SBS.

Thanks,

Alan.
0
 
Shaun VermaakTechnical Specialist/DeveloperCommented:
Have a look at this article on how to create global admin groups
https://www.experts-exchange.com/articles/29596/Securing-Active-Directory-Administrators-Groups.html
0
 
Robcarter10Author Commented:
Sorry for the delayed response. I was out sick from work the rest of last week after posting this. Dariusz, I have tried your solution and I got it to work one time. I am not that familiar with group policy since I have always used an SBS Server and most policies are preconfigured. Anyway, I setup a group for workstation admins and I am having trouble getting it to apply to the workstation. I was trying to use the scope to only get this policy to apply to certain computers and I did get the workstation admin group to appear in the builtin administrators group one time. In the process of trying to figure out how I did it, it disappeared again and I unable to get it to work again. I am guessing that the scope has something to do with it. Any advice?
0
 
AlanConnect With a Mentor ConsultantCommented:
Hi Rob,

Have you put the machines that you want the new tech to be able to administer into a new sub-OU, probably under SBSComputers?

If you already did that, then target the new GPO to that OU only.

Does that work?

Thanks,

Alan.
0
 
Robcarter10Author Commented:
That worked
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.