2

I'd like to have a local user in the admins group for when the computer isn't connected to the domain. Currently I use a start up script to create the user and add it to the admins group. Is there a way to use group policy to add a local user to the admins group?

Improve this question

2 Answers 2

Reset to default
4

Yes, you can use Group Policy's Restricted Groups to do this. The interface provides options to both look up domain groups, as well as enter non-domain group names.

In this image, local users "administrator" and "isc" are included along with the FCSD domain groups. Note that names are not verified against the local computer source, you must ensure the users exist.

enter image description here

Improve this answer
2
  • Thanks for the quick reply. The technet article made it sound like using this method will remove any groups/users who are not included in the Members of this group field, is that true? We don't want to remove any existing users in the admins group.
    – Peter
    Jan 26, 2011 at 16:30
  • @Peter: Yes using the "Members of this group" option will remove and overwrite existing members of this specified group -- in this case the local group "Administrators". You can always just include the users you don't wish to remove as well.
    – jscott
    Jan 26, 2011 at 18:35
1

The groups function in Group Policy Preferences will work around the issue identified with Restricted Groups doing a "replace" rather than a merge.

If you can't take a dependency on Group Policy Preferences (e.g. due to client OS/SP level), in you script also create a local group on the machine and put the user in the group. Instead of defining a restricted group for Administrators, define one for your new group and populate the "this group is a member of" section with Administrators.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .