I'm a bit new to AD management, so would appreciate some help in what may be a very simple task.

I've got a domain that manages a bunch of different servers, and I want to grant local administrative rights to some domain users to some of the servers (the development webservers).

I appreciate the group concept, so I imagine I would have to create a group containing the users in question another group containing the computers to grant them access to.

What's the best way of going about this?


You're on the right track. Now, you would need to create an Organizational Unit in Active Directory to place the servers in question in. Then, you create and link a group policy to that OU that adds the security group that you made into the local administrators group on the server.

  • I'm just muddling my way through this. I've created a new Policy Object, do I just add the Servers group to the 'security filtering' section, and then configure the 'Computer Configuration/Preferences/Control Panel Settings/Local Users and Groups' part of the policy to update the local admin group? – growse Mar 18 '11 at 15:59
  • That sounds about right. I generally go into "Computer configuration/Policies/Windows Settings/Security Settings/Restricted Groups" and assign them there, but the location you use might work better since it updates the Administrators group instead of mandating a set list of users in the group. I generally don't mess with security filtering and just assign the object to a whole OU, but your way seems a bit more elegant :-) – Hyppy Mar 18 '11 at 16:05
  • Thanks - I wanted to do the filtering, as there's other computers I specifically don't want these users having local admin on. – growse Mar 18 '11 at 16:07
  • 1
    You should always try to target the GPO to as specific of a group as possible. In general I don't use Domain Computers as a security filtering mechanism, I create a group that shares some naming with the GPO. I also "turn off" the unused section of the GPO i.e. - if it is a computer GPO, turn off the user side so GPO's process faster and there is no accidental settings that get applied. – BoxerBucks Mar 18 '11 at 16:39
  • Great comment of BoxerBucks. Try to link group policies to organization units and don't go deeper (computer specific/wmi filtering). That way it'll stay manageable. – dSebastien May 16 '12 at 6:24

You would create a security group in AD, lets call it "developers". You would then add this group as a member of the local admins group on each of these machines. You could do this manually on each of these machines if there aren't many, or look at using group policy to do so by putting these machines in a separate OU, and applying a policy to do this.

You would then add the users you want to have these rights to this group.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.