Manage Learn to apply best practices and optimize your operations.

Can I add domain groups to the local admin group through group policy?

I administer 1,200+ desktop computers running Win XP Pro. I want to know if there is a way to add domain groups to the local administrators group through group policy. I figured out how to manually add the groups to the local computer, but with hundreds of systems this can take weeks. FYI, we are running SMS and I noticed that it has added itself to the local admin group. The reason for this is there are several software programs that need local administrator rights in order to function properly. On any given computer, there are several dozen users that use the computer, and to add each user locally as a local admin is not a suitable option. As for security, we are running software called Deep Freeze. This software removes any changes and software added to the system when restarted.
Yes, there is a way. Create a Group Policy Object (GPO) that runs a WMI script as a logon script. The WMI script would then add the domain group to the local Administrators group. For examples of WMI scripts that you can use to create your own, see the TechNet Script Center at http://www.microsoft.com/technet/scriptcenter/default.asp.

Dig Deeper on Windows client management

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.