Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am experimenting with a home domain network based on Windows Server 2008. I initially assumed that since I am a domain administrator, I should also have full access rights to workstations on the domain. Then I read about 'local administrator' rights on workstations, and now it does not seem as clear cut.

Can somebody explain the relationship between a domain administrator and local administrator?

If I am a domain administrator, how can I obtain local administrator rights on all the domain connected systems? Can I make some super-administrator account? I need to be able to access them remotely if it makes any difference.


share|improve this question
up vote 3 down vote accepted

When you join a workstation or server to a domain, the Domain Admins group is added to the local Administrators group and the Domain Users group is added to the local Users group. The only instances where this would not be the case would be if you were to use the Restricted Groups function in a GPO to alter the group membership of these groups or if you manually alter the membership of these groups.

The scope of user rights granted to each group is as their names imply: Domain Admins have administrator rights in the domain, including on all workstations and servers in the domain (domain scope). Local Administrators have administrator rights on the workstation or server where they exist but have no rights in the domain or on other workstations or servers (local scope).

share|improve this answer
Thanks for the comprehensive answer, that gives me more food for thought. – TripleAntigen Jul 3 '11 at 15:52
Glad to help... – joeqwerty Jul 3 '11 at 15:58

The domain admins group should automatically be a member of the local administrators group on any given domain member, unless it has been explicity removed. Non-domain-admins can be added to the local administrators group on any domain member.

share|improve this answer
Thanks very much! – TripleAntigen Jul 3 '11 at 15:50

Nothing is set in place automatically. As the names suggest, Domain Admins are set to administer the domain, local admins administer the local computer. A member of the domain admins group, by default, does have administrative rights over the local computers. To clarify that, I mean that the domain admin group is automatically added to the local administrative group on domain pcs.

OR you can setup restricted groups in group policy to manage the local groups on domain PCs. With this option you would add the local admin account as a restricted group in the GPO. You would specify the domain or local account/ group in the Members section of the restricted group. You could use this method to give another domain group such as a "workstation support" group, admin rights on the PCs.

share|improve this answer
I think you're wrong with this statement : "I mean that the domain admin group is not automatically added to the local administrative group on domain pcs." – mfinni Jul 2 '11 at 3:05
A domain admin, by default, is member of the local admins group on all members. Statement factually wrong. – TomTom Jul 2 '11 at 4:45
Answer adjusted, I was mixing up the domain admin group with a non-default "workstation support" type group. – HostBits Jul 2 '11 at 12:55
Thanks for amendment. – TripleAntigen Jul 3 '11 at 15:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.