Q

Can I add domain groups to the local admin group through group policy?

I administer 1,200+ desktop computers running Win XP Pro. I want to know if there is a way to add domain groups to the local administrators group through group policy. I figured out how to manually add the groups to the local computer, but with hundreds of systems this can take weeks. FYI, we are running SMS and I noticed that it has added itself to the local admin group. The reason for this is there are several software programs that need local administrator rights in order to function properly. On any given computer, there are several dozen users that use the computer, and to add each user locally as a local admin is not a suitable option. As for security, we are running software called Deep Freeze. This software removes any changes and software added to the system when restarted.
Yes, there is a way. Create a Group Policy Object (GPO) that runs a WMI script as a logon script. The WMI script would then add the domain group to the local Administrators group. For examples of WMI scripts that you can use to create your own, see the TechNet Script Center at http://www.microsoft.com/technet/scriptcenter/default.asp.
This was first published in January 2004

Dig deeper on Windows Operating System Management

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchServerVirtualization

SearchCloudComputing

SearchExchange

SearchSQLServer

SearchWinIT

SearchEnterpriseDesktop

SearchVirtualDesktop

Close