Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the best user group for Visual Studio 2010 developers? Now we have added them as Member of Domain Users but under certain situations they need admin account.

We would like to give them more control on their machine but not on the domain network, of course.


share|improve this question
up vote 1 down vote accepted

If they need admin access to their machines, but not the domain at large, you could:

  • individually give them admin access to the local machine (fine if a rare occurrence), or
  • Create a domain group, create an OU of machines these people would need admin rights on, assign the group admin rights to only that OU (reasonable, but a lot of work if this is a rare scenario), or
  • create a domain group, assign it custom permissions to administer all machines in the domain but not the domain itself (least preferable)
share|improve this answer
I believe that option one could be fine, how do I do it practically? – Alberto Sep 26 '11 at 16:32
Are you asking how to grant local admin rights to a user's computer? For a couple users, I'd just use the Computer Mgt MMC, but possibly write a script to take user and computer names as args – gWaldo Sep 26 '11 at 18:54

The best group is the one that gives them the level of access they need to do their jobs but does not give them more access than they need to do their jobs, which is entirely dependent on what it is they need to do, which is determined by their manager.

share|improve this answer

If they are doing web development with anything earlier than visual studio 2010 they are going to need to be administrators of the machine so that they can debug processes running under a different user context. Most of the time this means debugging web apps on IIS. If they switch to 2010 they can use IISExpress instead. If they are doing anything that can be construed as system programming they will need admin access.

A good idea might be setting up a development forest that they can use virtual machines to do dev on. Developers also use email, calendars, and the like...try to keep those duties separate without deploying two workstations.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.