Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What I would like to do is grant permission for a domain account to log on to any server/workstation and be a local administrator with having to add this account to domain admin group?

This account only needs to be able to read folder sizes on all folders on a workstation/server.

Is there a GPO for that?

share|improve this question
possible duplicate of Remote Desktop Users via Group Policy Server 2008 – jscott Dec 20 '11 at 19:12
Also possibly of interest:… – jscott Dec 20 '11 at 19:16
@jscott Not an exact duplicate, but the process is absolutely identical except for the group that you choose from the drop down, so I voted for that as well. – MDMarra Dec 20 '11 at 19:22
up vote 0 down vote accepted

great how-to here:

share|improve this answer
Posting only links is really frowned upon. You should put the relevant content in an answer and then link to your source. – MDMarra Dec 20 '11 at 19:57
Thanks! I spoke to the network admin and we have a couple minor hurdles to jump over before we can do this, but your link is definitely going to help! – Dave Dec 20 '11 at 19:59
@mdarra Do you have something on the site to back that up? I'd certainly rather have a link to a complete answer rather than an incomplete answer. Your remark certainly goes against John Skeets advice here… – Jim B Dec 20 '11 at 21:21
@JimB Lucky for us, John Skeet doesn't run the Stack Exchange network. You should read this. There are also multiple posts on about this where all of the most highly voted/accepted answers say to provide more than just a link. – MDMarra Dec 20 '11 at 23:53
@JimB Also, the two are not mutually exclusive. I suggested leaving a summary AND the link. John Skeet even says this in the link that you provided : "it's worth including some sort of summary of what you're linking to - a link on its own doesn't really invite the reader to follow it, whereas a quick description of what they'll find there provides more incentive." – MDMarra Dec 20 '11 at 23:55

You can use Group Policy Preferences to update whatever local group to contain whatever users you want it to, including the local administrators group.

GPP Screencap

share|improve this answer

Yes, this is definitely possible with a GPO.

You need to be careful though, that the GPO that makes the user a local admin on every machine does not also apply to the domain controllers, because a local admin on a DC is a domain admin.

It's all just a matter of your particular OU structure, where the computer accounts are, if/how you configure "Enforced" or "Block Inheritance," and/or WMI filters. There are too many different ways to accomplish it to really go over them all.

For instance, a common scenario is to do something like apply a GPO to the "Accounting" OU that makes all members of the "Accounting Dept Admins" local administrators of all the computer accounts that reside in the Accounting OU.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.