Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to give administrative privileges to a group of user for a group of a PC in an Active Directory Enviroment.

For Example i have :

  • HelpDesk_User : Group of user
  • HelpDesk_PC : Group of Computer

I want to give at each member of HelpDesk_User group local administrator priviledges on each computer member of HelpDesk_PC. Can i do this throgh Group policy ? How ?

At the moment i add manually HelpDesk_User group(or each member of this group) to local administrator group for each computer, Is there a way to do it through centralized AD group policy ?


share|improve this question
up vote 10 down vote accepted

Yes, you're after Restricted Groups.

  1. Create a new GPO for the OU of your workstations.
  2. Computer Configuration -> Windows Settings -> Restricted Groups
  3. Right click, Add Group
  4. Choose your group for users who are going to be local workstation admins
  5. This group is a member of -> Add, and enter Administrators

Exit out of the GPO, and run gpupdate /force on the workstations to pick up the new GPO. Check in the local users/groups to see if your admins group is in the local administrators group.

See here for more pics:

share|improve this answer
You left out a hugely important bit of information re: Restricted Groups... This GPO setting will OVERWRITE the group it applies to. You need to add EVERY user/group that you want to be a member of the local "Administrators" group. – Ryan Fisher Oct 26 '10 at 19:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.