1

Can a local user group contain a domain group as a member?

Situation is this: Server 2012 has Hyper-V role installed, logon as non-Admin cannot access Virtual Machine Manager because of error:

you do not have the required permission

I can solve this by adding the user to the local 'Hyper-V Administrators' group which works fine but I would prefer to do this at the domain level.

So for example can I have a Domain\Hyper-V Administrators group which is a member of the local\Hyper-V Administrators group. Or perhaps I can somehow give appropriate permissions to run VMM to the Domain\Hyper-V Administrators group?

Improve this question

3 Answers 3

Reset to default
2

Local groups on domain member computers can have groups (Global, Domain Local, or Universal) from the domain nested within them. Creating your "DOMAIN\Hyper-V Administrators" group is certainly a viable idea.

You should look into using "Restricted Groups", which can allow you to perform this group nesting automatically on your domain-joined Hyper-V hosts. This HOWTO is nice, though it doesn't drive home the point hard enoguh that you'll really want to use the "This group is a member of" functionality more often than not.

Improve this answer
7
  • Problem seems to be that local 'Hyper-V Administrators' group on hyper-V host server cannot have 'domain\Hyper-V Administrators' group added as a member: 'Built-in groups cannot be added to other groups'. Tried using Restricted Groups GPO but seems same problem.
    – NickC
    Feb 19, 2014 at 11:43
  • That sounds like you're trying to add "MACHINE\Hyper-V Administrators" to the "DOMAIN\Hyper-V Administrators" group. Odd... I can confirm that I have a domain group nested into the local "Hyper-V Administrators" group on a Hyper-V 2012 machine.
    – Evan Anderson
    Feb 19, 2014 at 13:59
  • I am trying to add 'Domain\Hyper-V Administrators' as a member of 'VMHost\Hyper-V Administrators' but 'Domain\Hyper-V Administrators' is not in the list.
    – NickC
    Feb 19, 2014 at 20:44
  • For curiosity's sake, at a command prompt on the Hyper-V host run the command net localgroup "Hyper-V Administrators" "DOMAIN\Hyper-V Administrators" /add.
    – Evan Anderson
    Feb 19, 2014 at 21:33
  • Command just fails giving 'The syntax of this command is...' I have checked the command quite carefully and all is correct just seems that it cannot see the 'Domain/Hyper-V Administrators' built-in group.
    – NickC
    Feb 20, 2014 at 20:31
0

Yes, you can add a domain group to a local group on a domain-joined computer.

Improve this answer
1
  • But not apparently Built-in domain groups which I now realise is what I have been trying to do
    – NickC
    Feb 19, 2014 at 11:45
0

Yes, you can nest domain groups in local groups, and this is indeed usual practice: whenever a computer joins a domain, the "Domain Admins" group is automatically placed in the local "Administrators" group; this is how domain admins get their privileges on all domain-joined computers.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .