Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to have a local user in the admins group for when the computer isn't connected to the domain. Currently I use a start up script to create the user and add it to the admins group. Is there a way to use group policy to add a local user to the admins group?

share|improve this question
add comment

2 Answers 2

up vote 3 down vote accepted

Yes, you can use Group Policy's Restricted Groups to do this. The interface provides options to both look up domain groups, as well as enter non-domain group names.

In this image, local users "administrator" and "isc" are included along with the FCSD domain groups. Note that names are not verified against the local computer source, you must ensure the users exist.

enter image description here

share|improve this answer
    
Thanks for the quick reply. The technet article made it sound like using this method will remove any groups/users who are not included in the Members of this group field, is that true? We don't want to remove any existing users in the admins group. –  Peter Jan 26 '11 at 16:30
    
@Peter: Yes using the "Members of this group" option will remove and overwrite existing members of this specified group -- in this case the local group "Administrators". You can always just include the users you don't wish to remove as well. –  jscott Jan 26 '11 at 18:35
add comment

The groups function in Group Policy Preferences will work around the issue identified with Restricted Groups doing a "replace" rather than a merge.

If you can't take a dependency on Group Policy Preferences (e.g. due to client OS/SP level), in you script also create a local group on the machine and put the user in the group. Instead of defining a restricted group for Administrators, define one for your new group and populate the "this group is a member of" section with Administrators.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.