Home / server / Questions / 227188
Accepted
Peter
Asked: 2011-01-27 08:15:31 +0800 CST

Is it possible to add a local user to the admins group through group policy?

  • 772

I'd like to have a local user in the admins group for when the computer isn't connected to the domain. Currently I use a start up script to create the user and add it to the admins group. Is there a way to use group policy to add a local user to the admins group?

group-policy active-directory

2 Answers

  1. Best Answer

    Yes, you can use Group Policy's Restricted Groups to do this. The interface provides options to both look up domain groups, as well as enter non-domain group names.

    In this image, local users "administrator" and "isc" are included along with the FCSD domain groups. Note that names are not verified against the local computer source, you must ensure the users exist.

    enter image description here

    • 4

  2. The groups function in Group Policy Preferences will work around the issue identified with Restricted Groups doing a "replace" rather than a merge.

    If you can't take a dependency on Group Policy Preferences (e.g. due to client OS/SP level), in you script also create a local group on the machine and put the user in the group. Instead of defining a restricted group for Administrators, define one for your new group and populate the "this group is a member of" section with Administrators.

    • 1