I am experimenting with a home domain network based on Windows Server 2008. I initially assumed that since I am a domain administrator, I should also have full access rights to workstations on the domain. Then I read about 'local administrator' rights on workstations, and now it does not seem as clear cut.

Can somebody explain the relationship between a domain administrator and local administrator?

If I am a domain administrator, how can I obtain local administrator rights on all the domain connected systems? Can I make some super-administrator account? I need to be able to access them remotely if it makes any difference.



When you join a workstation or server to a domain, the Domain Admins group is added to the local Administrators group and the Domain Users group is added to the local Users group. The only instances where this would not be the case would be if you were to use the Restricted Groups function in a GPO to alter the group membership of these groups or if you manually alter the membership of these groups.

The scope of user rights granted to each group is as their names imply: Domain Admins have administrator rights in the domain, including on all workstations and servers in the domain (domain scope). Local Administrators have administrator rights on the workstation or server where they exist but have no rights in the domain or on other workstations or servers (local scope).

  • Thanks for the comprehensive answer, that gives me more food for thought. Jul 3 '11 at 15:52
  • Glad to help...
    – joeqwerty
    Jul 3 '11 at 15:58

The domain admins group should automatically be a member of the local administrators group on any given domain member, unless it has been explicity removed. Non-domain-admins can be added to the local administrators group on any domain member.


Nothing is set in place automatically. As the names suggest, Domain Admins are set to administer the domain, local admins administer the local computer. A member of the domain admins group, by default, does have administrative rights over the local computers. To clarify that, I mean that the domain admin group is automatically added to the local administrative group on domain pcs.

OR you can setup restricted groups in group policy to manage the local groups on domain PCs. With this option you would add the local admin account as a restricted group in the GPO. You would specify the domain or local account/ group in the Members section of the restricted group. You could use this method to give another domain group such as a "workstation support" group, admin rights on the PCs.

  • 4
    I think you're wrong with this statement : "I mean that the domain admin group is not automatically added to the local administrative group on domain pcs."
    – mfinni
    Jul 2 '11 at 3:05
  • 1
    A domain admin, by default, is member of the local admins group on all members. Statement factually wrong.
    – TomTom
    Jul 2 '11 at 4:45
  • Answer adjusted, I was mixing up the domain admin group with a non-default "workstation support" type group.
    – HostBits
    Jul 2 '11 at 12:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.