1

Can a local user group contain a domain group as a member?

Situation is this: Server 2012 has Hyper-V role installed, logon as non-Admin cannot access Virtual Machine Manager because of error:

you do not have the required permission

I can solve this by adding the user to the local 'Hyper-V Administrators' group which works fine but I would prefer to do this at the domain level.

So for example can I have a Domain\Hyper-V Administrators group which is a member of the local\Hyper-V Administrators group. Or perhaps I can somehow give appropriate permissions to run VMM to the Domain\Hyper-V Administrators group?

2

Local groups on domain member computers can have groups (Global, Domain Local, or Universal) from the domain nested within them. Creating your "DOMAIN\Hyper-V Administrators" group is certainly a viable idea.

You should look into using "Restricted Groups", which can allow you to perform this group nesting automatically on your domain-joined Hyper-V hosts. This HOWTO is nice, though it doesn't drive home the point hard enoguh that you'll really want to use the "This group is a member of" functionality more often than not.

  • Problem seems to be that local 'Hyper-V Administrators' group on hyper-V host server cannot have 'domain\Hyper-V Administrators' group added as a member: 'Built-in groups cannot be added to other groups'. Tried using Restricted Groups GPO but seems same problem. – NickC Feb 19 '14 at 11:43
  • That sounds like you're trying to add "MACHINE\Hyper-V Administrators" to the "DOMAIN\Hyper-V Administrators" group. Odd... I can confirm that I have a domain group nested into the local "Hyper-V Administrators" group on a Hyper-V 2012 machine. – Evan Anderson Feb 19 '14 at 13:59
  • I am trying to add 'Domain\Hyper-V Administrators' as a member of 'VMHost\Hyper-V Administrators' but 'Domain\Hyper-V Administrators' is not in the list. – NickC Feb 19 '14 at 20:44
  • For curiosity's sake, at a command prompt on the Hyper-V host run the command net localgroup "Hyper-V Administrators" "DOMAIN\Hyper-V Administrators" /add. – Evan Anderson Feb 19 '14 at 21:33
  • Command just fails giving 'The syntax of this command is...' I have checked the command quite carefully and all is correct just seems that it cannot see the 'Domain/Hyper-V Administrators' built-in group. – NickC Feb 20 '14 at 20:31
0

Yes, you can add a domain group to a local group on a domain-joined computer.

  • But not apparently Built-in domain groups which I now realise is what I have been trying to do – NickC Feb 19 '14 at 11:45
0

Yes, you can nest domain groups in local groups, and this is indeed usual practice: whenever a computer joins a domain, the "Domain Admins" group is automatically placed in the local "Administrators" group; this is how domain admins get their privileges on all domain-joined computers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.