1

Is there a way to give domain based accounts local admin access on specific machines and not others?

I can control access and rights to which machines a user can log in to and what their privileges are on a global scale but is there a way to control them on individual machines?

What we have now is an Active Directory group called Sec.LocalAdmin, we deployed this group 'Restricted Groups'. So every user that is a member of this group is local admin on every machine where this group is added to the Local Admin group. What we want is that every user is local admin on their own machine, is it possible to do this by a GPO?

5
  • What operating System?
    – Daniel
    Sep 29, 2016 at 9:20
  • Windows 7 and 8 Sep 29, 2016 at 9:31
  • That sounds like a terrible idea but have you tried - social.technet.microsoft.com/wiki/contents/articles/…
    – Fraser
    Sep 29, 2016 at 9:33
  • I would use a combination of scripting and the msDS-PrimaryComputer attribute.
    – Daniel
    Sep 29, 2016 at 9:47
  • @EmreGüllüoğlu If it's a one time thing for one user, I'd just do it manually. If it's one time, but multiple users on multiple machines I'd script it. Does the machines have some properties they share? any pattern as to who gets admin where?
    – EliadTech
    Sep 29, 2016 at 11:01

0

Browse other questions tagged .