What type of permissions and/or roles do you need to assign to a Active Directory (Windows Server 2008 R2) user to be local administrator on Windows 7?

  • Are you trying to grant local admin rights for a specific user to all computers in the domain or just a single computer? Feb 9 '13 at 3:04
  • Yes... grant local admin rights for a specific users to all computers in domain and/or enterprise. Feb 9 '13 at 3:15
  • OK, in that case my answer is not valid. You might want to edit your question to clarify this for any future visitors so they don't have to troll through comments. Feb 9 '13 at 15:01

You can do this across a domain in three different ways.

  1. Group Policy Preferences can be used to add domain users to local groups.

  2. Group Policy Restricted Groups.

  3. A startup script that runs net localgroup administrators /add userNameGoesHere

None of these options require adding the user in question to a built-in Active Directory group.

  • You basically do what MDMarra stated. I'm assuming your running Microsoft Server 2008 on your domain controller and not Server 2003. If you're running 2008, then go with Group Policy Preferences (GPP) which was the first option MDMarra pointed out, if 2003, then go with options 2 or 3, but I prefer option 2 if it is a 2003 server. The best method of course is GPP as was pointed out in option 1 using Item Level Targeting to identify the specific group you want. Feb 9 '13 at 4:17
  • 1
    @RonRatzlaff Pretty sure you can get those GPPs on 2003 too now btw. Just requires a client and domain software update. Feb 9 '13 at 15:00

This is a pretty common action for a computer by computer basis. There are tons of tutorials online about how to do this.

In general you do the following:

  1. Edit the local groups (like the tutorial I linked to above describes)
  2. Open the control panel in Windows and open the Users tool to add a user to the administrators group (screenshot below)

enter image description here

  • That's adding it on an individual level. I want to be doing this through AD and not have to modify 100+ desktop individually. Feb 9 '13 at 3:15
  • Yes, update your question to be more specific next time. Feb 9 '13 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.