How do I grant local administrator rights, but not Domain Administrator Rights?

windows active-directory windows-server-2003 permissions

7,397

Solution 1

You add them to the Administrators group on the computer in question, through the local users MMC snap-in.

Solution 2

If it's only a handful of computers, you can simply add the user to the local group Administrators on each client.

If you want to enforce this on a larger scale, you should employ Group Policies. In that case you can use Restricted Groups under Computer Configuration -> Windows Settings -> Security Settings.

7,397

Pratik Thakkar

I’m responsible for the development and continuous enhancement of our in-house portals by translating the needs of our users and seeking inputs from various internal stakeholders and developing useful features and functionality. My role requires me to balance user needs with commercial considerations and technical possibilities. I’m also responsible for the oversight of the Notting Hill Media Mumbai office. A Red Hat Certified Engineer and a graduate from one of India's leading IT training institutions NIIT, I have over 12 years' experience in building large web properties. Specialties: Product development, Project management, User Experience, Usability, PHP, MySQL, Linux SOreadytohelp

Updated on September 18, 2022

Comments

Pratik Thakkar over 1 year

How do I grant local administrator rights, but not Domain Administrator Rights?

i.e.

For user x, I want to grant install rights on the computer, but the user should not have Domain admin rights as I have a bunch of folders which are accessible only to administrators and not Domain users.

Server OS: Windows Server 2003 User OS: Windows 7
- Admin about 9 years
  
  If we add them to the Administrators group on the computer in question, through the local users MMC snap-in, does the user get rights to add other domain users as admin on that machine ? Assuming the user is a domain user...