Windows Server 2003 - Give User Full Admin Privileges

Question

I am running Windows Server 2003. There are a couple of user accounts that I would like to promote to Administrator accounts. I've tried several ways to do so, but I am still relatively new to setting up a server. If anyone has any ideas on how to go about promoting these users, I thank you in advance.

EDIT: I should probably mention that this a domain controller. I didn't realize that this changed the answer I was looking for. I apologize, like I said before I am new to the world of servers.

EDIT #2: I've added the users to the Administrator group like most of the answer recommended, but the users don't seem to have admin rights yet. I think this might be because they are also in the Domain Users group, which I can't seem to be able to remove them from.

Solution 1

When in computer management instead of going to "users" go to the "groups" section. Open up the administrator group and add the users to that group.

Edit:

You should be able to open up Administrative Tools -> Computer Manager -> Expand Local Users and Groups and find the group section - UNLESS there is some sort of domain policy not allowing you to see this group. It's entirely possible YOU are not a local administrator of that machine and therefore unable to see or make these changes?

If you want to do it at the domain level:

You need to log into the domain controller and open up users and groups and add the people to the domain admins group (IF you want them to be domain administrators)

Solution 2

I'll start by saying you should make sure you need these users to be Administrators, especially if this is a server. This gives them the ability to break things much more easily, so it's best to just delegate the specific access needed rather than give them full Administrator access.

If it's definitely necessary, you can click Start->Run and then type "lusrmgr.msc" (assuming this is not a domain controller). You'll see Users and Groups on the left, and if you go into Groups you'll see the Administrators group. If you are working in a Windows domain, I'd suggest creating a group in Active Directory to add into this Administrators group, and then add all of your users to that new group. This will make it easier to manage as it is not difficult to forget which users have direct membership to the local admin group. If that's not your situation, just go ahead and add the users to the Administrators group.

Comments

[Shanmugalakshmi]

What is your goal in giving these users additional access? Do they need to be able to do something in particular? For whatever they need, do they need to have this access across your entire domain (all servers and workstations), or just on this single domain controller?

[Adam P]

There is no groups section. I think this has something to do with the fact that my server is a domain controller. I've updated my original post.

[Adam P]

I've added the users to the Administrator group but they do not appear to have admin privileges. I think this is because they are also in the Domain Users group, which I don't seem to be able to remove them from.

[Adam P]

I've added the users to the Administrator group but they do not appear to have admin privileges. I think this is because they are also in the Domain Users group, which I don't seem to be able to remove them from.

[Adam P]

I've added the users to the Administrator group but they do not appear to have admin privileges. I think this is because they are also in the Domain Users group, which I don't seem to be able to remove them from.

[Adam P]

I've added the users to the Administrator group but they do not appear to have admin privileges. I think this is because they are also in the Domain Users group, which I don't seem to be able to remove them from.

[Ubuntuser]

The permissions are additive, so their membership in domain users is not a problem. How are you testing whether or not they have proper permissions? A couple of tips. One, the users will need to login after you change their permissions to have their rights updated within their current session. Also, running gpresult /r will show which groups the user has in permission to in the active session. The group membership result in gpresult should match what you see in the properties screen within ADUC.

[John Gardeniers]

It's really not a good idea to make users domain admins if they only need to be admin on certain computers. I recommend you undo that urgently.

[Patruni Murty]

I know that. In my case I needed a Domain Admin, because setting up local users on dozens of servers of the fleet to be local Admins for one specific persons just wouldn't worth the time.