Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on secure a Windows 2003 domain with 50 clients. The fist task where I'm working on is to remove technical support staff from the Domain Administrator group. But, I need that they can still:

  • Unlock User Accounts -> Done
  • Operate Servers (backups and reset) -> Done
  • Operate Printers -> Done
  • Troubleshooting workstations -> ! CHAN !

I was thinking to add a Domain Local Group named "Support" to "Local Administrator" group on each workstation, what do you think about this approach?


share|improve this question
up vote 7 down vote accepted

If they're going to need to troubleshoot workstations, they'll indeed need local Administrator rights.

Your approach is right: use a domain group (but it has to be domain global if you want to nest it inside anythyng else), and put user accounts into it; it's best to not assign permissions to specific user accounts, groups exist exactly for this purpose.

About adding the group to the local Administrators group on each workstation: plase don't do that by hand :-)

Use either a simple machine startup script with the command net localgroup Administrators /add DOMAIN\YourGroup, or the Restricted Groups group policy setting.

share|improve this answer

Create a "Workstation Admin" Domain Local scoped group. Put all workstations in a common OU hierarchy or same OU. Link a GPO with a restricted groups setting for the admin group to include Workstation Admin only. Now, next any logical groups of personnel into that group who should have this access. You likely would want "Support" and "Domain Admins" nested in that group.

share|improve this answer
Be careful with Restricted Groups, that will remove any existing local admin other than the ones you specify. – Massimo Aug 7 '10 at 16:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.