Home / server / Questions / 213278
In Process
Eslam
Asked: 2010-12-17 04:51:20 +0800 CST

How to add a domain user to the local admin group remotely?

  • 772

I need to add a domain user in the local administrator group remotly and I have to the local admin password

active-directory users groups local

5 Answers

  1. psexec will do it remotely combined with 'net localgroup' command.

    from command line: 

    psexec \\remotename -u username -p pwd net localgroup Administrators "domain\user" /add

    you can also then batch that or use some scripting to apply to a group of machines. or you could always use powershell.

    • 8

  2. Another option - you can open up Local Users and Groups for the remote computer using this command:

    lusrmgr.msc /computer=computername
    • 5

  3. You can add a user to a group remotely by using the Group Policy Management Console. I would do the following:

    • Create an OU for the hosts that will have the user placed in the local group
    • Load the Group Policy Management Console
    • Locate the OU you created above and create a new group policy (the arrow points to what would be an OU) by right mouse clicking on the OU folder and select "create a GPO in this domain and link it here"

    alt text

    • Name it something that makes sense to you
    • right mouse and choose edit
    • Click down into the policy Windows Settings->Security Settings->Restricted Groups

    alt text

    • Add a group called Administrators (This is the group on the remote machine)
    • Next to the "members in this group" click add
    • Add domain admins to the group first
    • Add the group or person you want to add second
    • Click ok
    • Move the host into the OU you created above
    • Log in to the host and run gpupdate
    • Check the local groups, the person or group you specified should be in there.
    • 4

  4. If you're looking for a one-off method, you can also open the remote computer in Computer Management, click on Local Users and Groups -> Groups -> Administrators. Then add the domain group there.

    This is really only practical for a few workstations. Otherwise Group Policy (the method Tom mentioned, or using Group Policy Preferences) is preferred.

    • 4

  5. You can also do it by "simply" using groups.

    Create a domain group local_admin , then make it a member of the computers local administrators group.

    Then its a simple matter of making the domain user account a member of the domain local_admin group

    Since we use pre-configured templates for our company installations we already have this configured before a user ever gets his PC. Giving us a simple way to give a specific user or group local administrative privileges on all our computers domain computers

    • 0