Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have several development machines where I am the administrator. We are using AD in my organization but is maintained by and offshore IT group any request takes a long time.

We are currently granting access to developers on development machines manually so it's a bit annoying to maintain although at least it's fast. We have also a lot of external consultants that need to use those machines for some time.

Is there any tool or method to maintain a set of users synced on those machines without the need add them to an AD group?

share|improve this question

Yeah, manual work or scripting, for what you're describing. The problem will be if the main group is using something like Restricted Groups in AD (which they probably should be) which will wipe out your manual changes at every GPO refresh.

What you should do is get a GPO to add a certain Security Group to local admins on a certain group of Windows machines, and then let you be the manager of the group, so that you can add/remove members from it as necessary. The tools are all there; use them the right way.

share|improve this answer
Thanks, but as a developer more than IT I don't get it at all... I been looking how GPO works but I don't see if that fullfits my expectations. The GPO has to be created on every machine? How I can maintain the allowed users list? I don't have access to AD – guillem Oct 12 '12 at 21:45
Do you mean that I need to do a request to be the admin of a GPO in my organization so I can then add users to it? My organization is 60K users but I can try to do a request to get one of these – guillem Oct 12 '12 at 22:02
GPO is managed centrally (through Active Directory). AD "applies" the policy to users or machines at boot and/or login. – tomjedrz Oct 13 '12 at 2:56

If you already have a user with local administrator privileges, then you can create a script to create local users on each computer, and put it into the scheduled tasks to run every day. Use the "net user" command in the script.

Note -- if an end user did this in a network I manage, I would do everything possible to get them dismissed. But my staff would be responsive to your requests.

The best solution is to ask central IT for the following:

  • a security group called "local admins for guillems department"
  • create a GPO the puts that group into the "Administrator" group on each PC in your department.
  • delegate permission to you to manage the members in that group.

If their AD is properly organized, these should take a good admin roughly 10 minutes to do. But central IT, especially offshore central IT that is paid by the hour or by the request, is loath to delegate tasks that they can be paid to do.

Good luck.

share|improve this answer
Thank you @tomjedrz, now I have things much clearer. I will request a GPO although I'm not sure if IT have this on their policy. Are really scripts with net user the only alternative? No alternative tool for an unskilled user :-) – guillem Oct 13 '12 at 8:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.