Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to get a little help in tuning my Active Directory. I would like to be able to give the right of 'local administrator' to a group of users already defined in AD. This is in order not to have to log on to each machine and assign local administrator rights one by one to each user needed.

share|improve this question

Personally I would use Group Policy Preferences to achieve this:

  1. Open up a GPO in the editor as normal
  2. Expand either "Computer Configuration" or "User Configuration" depending on your desired result
  3. Expand "Preferences"
  4. Expand "Control Panel Settings"
  5. Select "Local Users and Groups"
  6. Right click near "There are no items to show..." and select New -> Local Group

I would recommend using a computer policy, configured as follows:

Action: Update (This is important, if you use replace you will remove anyone currently in the group)

Group Name: Administrators (Built-In)

Rename To: [Leave Blank]

Description: [Leave Blank]

Delete All Member Users: [Unselected]

Delete All Member Groups [Unselected]

Members: [Add specific AD users and groups here]

If you're new to Group Policy Preferences, I'd recommend getting familiar and learning about some of the new terminology. Despite being part of Group Policy, they're very different to old Group Policy settings.

Here's a good place to start:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.