Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

What type of permissions and/or roles do you need to assign to a Active Directory (Windows Server 2008 R2) user to be local administrator on Windows 7?

share|improve this question
    
Are you trying to grant local admin rights for a specific user to all computers in the domain or just a single computer? –  Brent Pabst Feb 9 '13 at 3:04
    
Yes... grant local admin rights for a specific users to all computers in domain and/or enterprise. –  Albert T. Wong Feb 9 '13 at 3:15
    
OK, in that case my answer is not valid. You might want to edit your question to clarify this for any future visitors so they don't have to troll through comments. –  Brent Pabst Feb 9 '13 at 15:01

2 Answers 2

You can do this across a domain in three different ways.

  1. Group Policy Preferences can be used to add domain users to local groups.

  2. Group Policy Restricted Groups.

  3. A startup script that runs net localgroup administrators /add userNameGoesHere

None of these options require adding the user in question to a built-in Active Directory group.

share|improve this answer
    
You basically do what MDMarra stated. I'm assuming your running Microsoft Server 2008 on your domain controller and not Server 2003. If you're running 2008, then go with Group Policy Preferences (GPP) which was the first option MDMarra pointed out, if 2003, then go with options 2 or 3, but I prefer option 2 if it is a 2003 server. The best method of course is GPP as was pointed out in option 1 using Item Level Targeting to identify the specific group you want. –  The_Ratzenator Feb 9 '13 at 4:17
1  
@RonRatzlaff Pretty sure you can get those GPPs on 2003 too now btw. Just requires a client and domain software update. –  Brent Pabst Feb 9 '13 at 15:00

This is a pretty common action for a computer by computer basis. There are tons of tutorials online about how to do this.

In general you do the following:

  1. Edit the local groups (like the tutorial I linked to above describes)
  2. Open the control panel in Windows and open the Users tool to add a user to the administrators group (screenshot below)

enter image description here

share|improve this answer
    
That's adding it on an individual level. I want to be doing this through AD and not have to modify 100+ desktop individually. –  Albert T. Wong Feb 9 '13 at 3:15
    
Yes, update your question to be more specific next time. –  Brent Pabst Feb 9 '13 at 15:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.