Assigning "domain user" to "local admin" on select PCs

[jeffc]

Assigning "domain user" to "local admin" on select PCs

I'd like to assign a few select "domain users" to be local admin over their test machines which log into a domain. The test machines are Windows 7 64bit and the domain is Win2k8 R2. I have been searching around for the best way to do it but I've come up short on my search.

Anyone know off the top of their head?

Thanks

 

[DC187]

Create a new group in AD, for example, TestUsers
Add the required users to the group
Go round each machine and add the group as a member of local admins.

 

[win7clutz]

At the server go to user settings and add them to the domain administrator group.

 

[DC187]

At the server go to user settings and add them to the domain administrator group.

That's not good advice at all, that will make all those users administrators across the entire domain which I don't think is the desired effect and could become quite a security issue.

 

[jeffc]

At the server go to user settings and add them to the domain administrator group.

That's not good advice at all, that will make all those users administrators across the entire domain which I don't think is the desired effect and could become quite a security issue.

Correct. I don't want them to be domain admins. Just local admins on specific test machines.

Thanks everyone!

 

[patwhatsthat]

Not sure how simple or complicated your actual task is
Simple? try this
to add someone to a group
net localgroup GroupName UserName /add
to remove
net localgroup GroupName UserName /delete
complicated?
Google, manage group membership + powershell

 

[Tempest]

I'd like to assign a few select "domain users" to be local admin over their test machines which log into a domain. The test machines are Windows 7 64bit and the domain is Win2k8 R2. I have been searching around for the best way to do it but I've come up short on my search.

Anyone know off the top of their head?

Thanks

Too easy Jeff - all you need to do is:

1. log in to each "test" PC as the local admin
2. Go to "Control Panel", "User Accounts"
3. Go to "Manage User Accounts", then the "Advanced" Tab
4. Click on the "Advanced" button in the middle of the form
5. Open the "Groups" folder, then double-click on the "Administrators" group.
6. Click "Add", then add the relevant user (Username@Domain)
7. OK (etc) to close all the windows.
8. Log off the local admin account, then log in to the domain user and test.

 

[Mysterchr]

The "Wizard" Way

I'd like to assign a few select "domain users" to be local admin over their test machines which log into a domain. The test machines are Windows 7 64bit and the domain is Win2k8 R2. I have been searching around for the best way to do it but I've come up short on my search.

Anyone know off the top of their head?

Thanks

Too easy Jeff - all you need to do is:

1. log in to each "test" PC as the local admin
2. Go to "Control Panel", "User Accounts"
3. Go to "Manage User Accounts", then the "Advanced" Tab
4. Click on the "Advanced" button in the middle of the form
5. Open the "Groups" folder, then double-click on the "Administrators" group.
6. Click "Add", then add the relevant user (Username@Domain)
7. OK (etc) to close all the windows.
8. Log off the local admin account, then log in to the domain user and test.

Tempest would you call this the "Wizard" way of doing this? For years I've always gone through computer management to add domain users to local groups however my new boss just informed me that I must use the wizard to do these things, "that's why their there." Yet he could not tell me what exactly the wizard way of adding a domain user to the administrators group on a local win 7 machine is.

 

[baespey]

Note, you can also do this through MMC 3.0 snap ins at your own PC. Just launch it up, connect to another computer, and do anything you desire through there.

 

[hehe]

Easiest way to administer local admins

How to make a user a local admin on just one computer, by just adding this computer’s name to the user’s Description in AD. security - Group Policy: Administrator Rights for Specific Users on Specific Computers - Server Fault Works in 8.1 and Win 7, just one short script an a oneliner GPO.