Give local admin rights to user on domain computers

Use the SBS console to assign the user to the computers.
https://technet.microsoft.com/en-us/library/cc527565%28v=ws.11%29.aspx?f=255&MSPPError=-2147217396

Or restricted groups if you're planning on getting rid of the SBS server (which you should probably). :)

I agree with using Restricted Groups for this (should work on SBS too - not sure why it wouldn't Jeremy?)

I would create a Security Group, probably for now with only the new IT Tech in it, then deploy that group to all machines that you want them to have full admin access to using a Restricted Group GPO, and put the group in the local machine's Administrators group.

To make it easy to manage, I would have a separate OU for the user machines that they can access (probably a new sub-OU under the existing one) and put the user machines that they are allowed to manage in that new OU, then target the GPO to machines in that OU.


Alan.

I agree with using Restricted Groups for this (should work on SBS too - not sure why it wouldn't Jeremy?)

Oh it definitely would but with SBS you can assign the user as an admin to all the computers in just a few clicks.

Also, since it's SBS, I wouldn't mess with the OU structure unless you don't want to use the SBS console. There are some things you can do with it but generally, you should just use the SBS console to administer an SBS server.

Hi Jeremy,

I see - totally agree about using the console / wizards with SBS.

Thanks,

Alan.

Have a look at this article on how to create global admin groups
https://www.experts-exchange.com/articles/29596/Securing-Active-Directory-Administrators-Groups.html

Sorry for the delayed response. I was out sick from work the rest of last week after posting this. Dariusz, I have tried your solution and I got it to work one time. I am not that familiar with group policy since I have always used an SBS Server and most policies are preconfigured. Anyway, I setup a group for workstation admins and I am having trouble getting it to apply to the workstation. I was trying to use the scope to only get this policy to apply to certain computers and I did get the workstation admin group to appear in the builtin administrators group one time. In the process of trying to figure out how I did it, it disappeared again and I unable to get it to work again. I am guessing that the scope has something to do with it. Any advice?

That worked