Home / server / Questions / 607302
Accepted
Jason
Asked: 2014-06-24 06:33:18 +0800 CST

Giving AD user accounts admin access on specific machines

  • 772

Is there a way to give domain based accounts administrative access on specific machines and not others?

I can control access and rights to which machines a user can log in to and what their privileges are on a global scale but is there a way to control them on individual machines?

windows

2 Answers

  1. Best Answer

    Yes.

    You can add domain accounts to individual machines, and into whatever groups you want on individual machines as well. On a manual, one-off basis (for example, NET LOCALGROUP Administrators [domain]\[account] /ADD), programmatically with a script, or even using Group Policy to handle it dynamically and automatically.

    • 12

  2. Add them to the local administrators group on the individual machines. If you want to manage this centrally then add a domain security group per machine/group of machines enabling you to add/remove members of those groups in active directory.

    • 1