I'm trying to rename the local administrator account on all the PCs in a 2003 domain. The GP I have that uses GPP to rename the local administrator seems to work. However the problem I'm having is when the local administrator account is not named "Administrator" and is instead whatever the person installing the operating system before it was joined to the domain typed into the user box like "Bob" or "User". The new administrator account gets added, but the old one doesn't get replaced.

Unfortunately we still have some users that require local admin priviledges, or I would just wipe that group rename the admin and be done. Is there any way to remove all other locally created admin accounts and leave the domain accounts in the local admin group via GP?

If I'm being convoluted the Local Administrators group contains these accounts: renamedAdmin, Bob, DOMAIN\someUser. I want it to only contain renameAdmin and DOMAIN\someUser. Any solution to this? Thanks.


You can do this with the GPO Restricted Groups

Computer configuration > Windows Settings > Security Settings > Restricted Groups.

If you set that up with Using the "Members" Restricted Group Portion of Policy, it will remove anything else that is listed locally. It will only apply the group that is in your policy. You can read more about it here. If other users need local admin rights, I might dump them into a Security Group, then add that Security Group to the Restricted Groups.

Also note, you'll want to make sure to include domain admins and your new local administrator in this group, or no one will be the local admin group.

  • I created a group with the name Local Admins, added the members renamedAdmin and DOMAIN\Domain Admins and member Of Administrators but it doesn't seem to be taking effect? Or am I doing something wrong? – Shawn Jul 6 '11 at 16:41
  • @Shawn Let's break this down into 2 parts. First you have to setup the security groups correctly. Which is sounds like you have that setup with your above post. After that, you need to setup a Group Policy for Restricted Groups and add your Local Admins security group to the Members Restricted Group as outlined above. – Nixphoe Jul 6 '11 at 17:21
  • Looking at my GP it says Group: BUILTIN\Administrators Members: DOMAIN\Admins, localAdmin Member of: BUILTIN\Administrators. It doesn't seem to be taking effect though, as the Administrators group on the PC hasn't changed. Am I missing something? I verified that the GP is being applied to that PC. – Shawn Jul 7 '11 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.