Previous administrator configured Restricted Groups in the Default Domain Policy. In the Restricted Groups for Administrators, they've added the Domain Admins group as well as a domain security group called Local Admins. They populate the Local Admins group with about 15 users that require local administrator access on their own systems. They've scoped this out to an OU that contains all computer objects in the domain. Expected result, as guessed, is that these users now have local admin access on all hosts.

I would like to redesign this a bit and am looking for some advice. Currently, if I grant a user local admin access on their own system; when GPO refreshes, the Restricted Groups portion removes their access. For obvious security reasons, I don't want them to have access on every machine. Management is aware of the risks associated with users having local admin access and has accepted the risks (these are mostly in-house developers).

Ideal goal....develop method where Domain Admins have access on all systems while being able to assign local admin rights for a small group of users to their OWN systems and no one elses. I'm not entirely certain if I can do this purely with Restricted Groups, or through a mixture of multiple GPOs. Am completely open to any other ideas from people who have implemented this too.

Thank you!


You would need to create new OUs. 1. group the computer accounts into new OUs. 2. block inheritance on the new OU's & do not enforce the default domain policy. 3 create a copy of default domain policy and edit it adding required accounts into users rights assignment and link it to the new OUs.

We had a similar requirement "local admin rights for a small group of users to their OWN systems and no one else" and this is what we did.

or else in active directory users and computers restrict users to logon onto only their computer(hostname) with the default domain policy in place.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.