Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm wondering if there is a way to simply my process(es).

Currently I have Windows XP workstations, Windows Server 2008 R2, Active Directory and Domain Services, Folder Redirection.

When a user currently logs in to a workstation, their documents, etc. are synched to the workstation and the user can begin working. However, there are a multitude of programs that we use in our environment that require higher than Power User privileges on the workstation. So in order for some users to function, we have to add the user to the Local User Accounts, and set them as an Administrator.

Is there a way for me to eliminate this? Is there a way for me to maintain my current setup yet not have to visit each station and set up users as Administrators for some of their software to properly function?

share|improve this question

migrated from Mar 22 '11 at 21:28

This question came from our site for computer enthusiasts and power users.

You can add the domain user to the local groups, I'm looking for a more automated way to do this without having to physically go to the workstation and add the user. – RogueSpear00 Mar 22 '11 at 19:49
up vote 1 down vote accepted

You can add domain users to local groups. Domain-wide, this can be done using Restricted Groups.

share|improve this answer
This may have answered my question, I will test this out and verify. Thanks! – RogueSpear00 Mar 22 '11 at 19:59
I'm marking this as answered unless proven otherwise! Thanks for the help Grawity! – RogueSpear00 Mar 22 '11 at 20:02
This is correct, but there are two ways to do it. One way will wipe your local admins group with everyone except the user you specify. The other way will add your user to the local admins group. Be sure you test and know the difference before you put it into prod. I did this once the wrong way by accident :) – BoxerBucks Mar 22 '11 at 21:38
@BoxerBucks: Care to explain which way is the Right One? (Feel free to edit the post.) – grawity Mar 22 '11 at 21:50
The "right one" to me is the one that adds your account to the local admins group. In the security setting make sure you specify your account as the account to act on and that you specify it as a member of local admins. It's easy to think to put Local Admins as the group to act on and to add your account to it. That is called "rip and replace" and it will replace local admins with just your account or group as opposed to adding it as another member. – BoxerBucks Mar 23 '11 at 2:19

Create a group in AD (lets call it localadmins). In group policy set the restrictive group settings on administrators to add that group (localadmins) to administrator. Add the users to that locadmins group as needed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.