Really need help with this.

I need to allow someone else to be administrator for client computers and servers but not for domain controller.

I was able to do that but whatever I do that user is allways part of administrators group and can logon to DC, create OU etc.


  1. create domain user (TestAdmin)
  2. create group (LocalAdmins)
  3. add user to group (then make group primary and remove user from Domain Users group)
  4. create GPO (gpoLocalAdmin)
  5. edit policy (Windows Settings->Security Settings->Restricted Groups) new group -> select -> LocalAdmins
  6. This group is member of (select -> administrators)
  7. gpupdate

This policy is not deployed to domain controlers (different OU) but TestAdmin can logon and administer domain.

How to fix this.


  • I have two questions for you: Why did you remove the user from Domain Users? Have you run a GP Results against the Domain Controller's Computer Policy to see whether your policy is somehow applying? – liam Nov 21 '15 at 16:26
  • What do you mean they can administer the domain? Are you saying that they can log onto the Domain Controllers? – joeqwerty Nov 21 '15 at 17:39
  • Yes, logon to DC, edit other users, move objects etc. Full admin as on other servers. How can i check that policy is not somehow applying other than using gpresults – Carlo Nov 21 '15 at 19:44
  • Can you explain why you can't use gpresult? – howtired Nov 21 '15 at 21:59
  • I misspoke in the above post. I was using gpresult to check if policy is applying and is not but to me it looks it is because that user can still logon to DC. I was looking for alternative method to check – Carlo Nov 21 '15 at 22:09

First off, unless you have a really good reason, don't remove this user from Domain Users. Also, there is almost never a reason to change the primary group. IIRC this setting exclusively applies to POSIX applications, and has no bearing whatsoever on anything security related.

That aside, you have the right idea here. Add a domain user to a domain group, then use Group Policy to add the domain group to the local Administrators groups. You went wrong in step 5, where you have the group membership reversed.

In effect, what you just asked GP to do is "take a domain group and add it to the local administrators group. This sounds correct, but look a bit closer and realize which element you're asking Group Policy to modify - in this case, you're asking it to modify the domain group by adding it to the local group, which will never work. Since Group Policy is always processed on client systems, you can't ever modify domain accounts, you can only modify local accounts.

To get this working correctly, you need to ask group policy to modify the local group by adding the domain group to it. To do this, open Restricted Groups, and start by selecting the Administrators group on the local system (don't worry, it will work for the corresponding group on any system):

Add Restricted Group

Then, modify it by adding the domain group as a member:

Modify Restricted Group

  • Thanks. I realized it, but I forgot to write here. Many thanks for great answer. I hope it will help someone in future. – Carlo Dec 3 '15 at 16:11
  • No problem, glad it's working for you! – tfrederick74656 Dec 3 '15 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.