What I would like to do is grant permission for a domain account to log on to any server/workstation and be a local administrator with having to add this account to domain admin group?

This account only needs to be able to read folder sizes on all folders on a workstation/server.

Is there a GPO for that?


great how-to here: http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

| improve this answer | |
  • 3
    Posting only links is really frowned upon. You should put the relevant content in an answer and then link to your source. – MDMarra Dec 20 '11 at 19:57
  • Thanks! I spoke to the network admin and we have a couple minor hurdles to jump over before we can do this, but your link is definitely going to help! – Dave Dec 20 '11 at 19:59
  • @mdarra Do you have something on the site to back that up? I'd certainly rather have a link to a complete answer rather than an incomplete answer. Your remark certainly goes against John Skeets advice here msmvps.com/blogs/jon_skeet/archive/2009/02/17/… – Jim B Dec 20 '11 at 21:21
  • @JimB Lucky for us, John Skeet doesn't run the Stack Exchange network. You should read this. There are also multiple posts on m.so about this where all of the most highly voted/accepted answers say to provide more than just a link. – MDMarra Dec 20 '11 at 23:53
  • 1
    @JimB Also, the two are not mutually exclusive. I suggested leaving a summary AND the link. John Skeet even says this in the link that you provided : "it's worth including some sort of summary of what you're linking to - a link on its own doesn't really invite the reader to follow it, whereas a quick description of what they'll find there provides more incentive." – MDMarra Dec 20 '11 at 23:55

You can use Group Policy Preferences to update whatever local group to contain whatever users you want it to, including the local administrators group.

GPP Screencap

| improve this answer | |

Yes, this is definitely possible with a GPO.

You need to be careful though, that the GPO that makes the user a local admin on every machine does not also apply to the domain controllers, because a local admin on a DC is a domain admin.

It's all just a matter of your particular OU structure, where the computer accounts are, if/how you configure "Enforced" or "Block Inheritance," and/or WMI filters. There are too many different ways to accomplish it to really go over them all.

For instance, a common scenario is to do something like apply a GPO to the "Accounting" OU that makes all members of the "Accounting Dept Admins" local administrators of all the computer accounts that reside in the Accounting OU.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.