I'd like to have a local user in the admins group for when the computer isn't connected to the domain. Currently I use a start up script to create the user and add it to the admins group. Is there a way to use group policy to add a local user to the admins group?


Yes, you can use Group Policy's Restricted Groups to do this. The interface provides options to both look up domain groups, as well as enter non-domain group names.

In this image, local users "administrator" and "isc" are included along with the FCSD domain groups. Note that names are not verified against the local computer source, you must ensure the users exist.

enter image description here

  • Thanks for the quick reply. The technet article made it sound like using this method will remove any groups/users who are not included in the Members of this group field, is that true? We don't want to remove any existing users in the admins group. – Peter Jan 26 '11 at 16:30
  • @Peter: Yes using the "Members of this group" option will remove and overwrite existing members of this specified group -- in this case the local group "Administrators". You can always just include the users you don't wish to remove as well. – jscott Jan 26 '11 at 18:35

The groups function in Group Policy Preferences will work around the issue identified with Restricted Groups doing a "replace" rather than a merge.

If you can't take a dependency on Group Policy Preferences (e.g. due to client OS/SP level), in you script also create a local group on the machine and put the user in the group. Instead of defining a restricted group for Administrators, define one for your new group and populate the "this group is a member of" section with Administrators.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.