Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a process where I work, where any changes to active directory GPOs are performed on test servers, backed up and then the backups applied to the live AD.

I'm in the process of amending a GPO where I want to specifically add in a user rights assignment for a user account that'll exist locally on the member servers that the GPO will apply to.

I've tried adding the word BUILTIN to the front of that user, I've tried using migtables, I've tried creating the user on the domain (but that ends up as trying to apply the user rights to the domain user of that name if he exists..).

Not sure what to do, Googling comes up with a lot of results that don't tend to lead anywhere for this scenario (local, user, group, policy all very common terms together).

Any suggested way of doing this?

share|improve this question
You would do this by just typing the name in to the first popup of the add to user right assignment. Bulitin only work for the accounts and groups shipped with windows. – Bernie White Nov 6 '12 at 19:27
up vote 1 down vote accepted

Perhaps, you can try the following:

  1. Create a separate group for the user locally.
  2. Create GPO and configure Restricted Groups in GPO to apply only to the local group created in step 1.

Description of Group Policy Restricted Groups

This is mentioned in the article if you follow the link:

Restricted Groups is a client configuration means and cannot be used with Domain Groups. Restricted Groups is designed specifically to work with Local Groups.

share|improve this answer
Seemed to work as expected. Thanks for the help. – daed Nov 12 '12 at 11:14

If you will be using the same local account name on each of the member servers, you can enter it like this in the GPO:


The .\ notation simply refers to the local computer when the setting in the GPO is applied. It is similar to entering domainName\accountName.

If you will be using a different account name on each of the member servers, then the solution will not be elegant. This approach would require you to either create a unique GPO for each member server's user rights assignments, or enter everything in one ugly (and less secure) GPO like this:

server1\localUsername1, server2\localUsername2, server*N*\localUsername*N*

The best thing that you can do to begin with is to create domain service accounts instead of local accounts.

Hope this helps.

share|improve this answer
Domain controller came up with a message of "The following Accounts could not be validated when I tried to add .\localUserName to the user rights assignments, ended up using the solution below. Thanks for the help. – daed Nov 12 '12 at 11:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.