Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a good way to solve the following?

  • Domain has an AD security group called "Workstation Administrators", for users that should not be domain admins, but should have local administrative control over all workstations in the domain
  • Technicians frequently forget to manually add this group after joining a PC to the domain and wastes time later on having to diagnose, go back and do it

Anybody know an automatic way of adding this group, or running a script on domain-join? Or would we need to run an automated audit process every so often after the fact?

share|improve this question
up vote 9 down vote accepted

Create a Group Policy Object and link it to the topmost OU that has workstation accounts. Then configure the Restricted Groups settings to add "Workstation Administrators" to the local group "Administrators" (or whatever the name is in your locale).

How-to: Using Restricted Groups

share|improve this answer
+1 - Restricted Groups is your friend for this. The only complaint I have with it is that a Restricted Groups policy can't merge with the existing local group membership or other Restricted Groups policies that apply to that computer. I have Customers where I have a "All PCs in the Organization Local Administrators" group and several "All PCs in Building #xx of City xxx Local Administrators" groups and a whole mess of Restricted Group policies to make it work. It'd be nice if the policies could just "stack"... – Evan Anderson Jul 31 '09 at 19:18
Actually if you are using Group Policy extensions for Win2008 you can modify the Admins Group and remove and add individual members:… - According to the article you just need to have a Win2008 or Vista SP1 machine on the domain to access the tools. I've never used it myself, but given the way GP is processed, I imagine you could use separate GPOs to stack permissions throughout the directory like you want. – August Jul 31 '09 at 19:31
This is perfect! Thank you.. – Brandon Jul 31 '09 at 19:41
Evan: Actually you can merge settings. Just use the second option. What I mean is you make "Workstation Admins" a restricted group and make sure it is always a member of "Administrators" (using the second listbox/add button in the restricted group properties). – chankster Jul 31 '09 at 19:46
chankster YES! Not enough people realize how that second option is used. – Ryan Bolger Jul 31 '09 at 22:56

If Restricted Groups is too restrictive, or you are unable to utilise Group Policy Client-side Extensions, you can use a VBScript assigned as a GPO computer startup script linked to the relevant OU/s.

See KB555026.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.