Add Managed By AD value to Local Administrator group.

Hi,
I'd like to add the user account of the AD computer's Managed by attribute to the Local Administrator Group.
Could that be done via GPP?
Thanks in advance.

Hi,
I am doubtful about it, as when I run %manager%, the system could not recognize the variable, and also I didn't find out the environment variable.
I would like suggest you use script to do that, first retrieve all "Managers", then add them to each computers local admins group.
For scripting, please refer to the below link:
http://social.technet.microsoft.com/Forums/en-US/ITCG/threads
Best Regards,
Yan Li
Yan Li
TechNet Community Support

Similar Messages

How to add first log on user to local administrator group

Hi All,
When first time user log in to system, i need to add that particular user to local administrator group?
How to achieve it using vbscript?
Thanks
Divakar

It is also now against federal law in the US, Canada and, I believe, the UK.
In the US HIPAA and the federal network security act (???) and Sarbanes-Oxley all prohibit users running as Admins. This may not specifically affect your
installation but it does show how important this is.
There is NEVER a good reason to make a user an administrator. It is only lack of technical know how that leads to this scenario. Any vendor product that
requires this is not a safe product to use in a corporate network. Malware specifically looks for this as an attack vector.
I spent three years arguing with Inuit to get there software to work. Every time they said you have to run as an admin I told them it would never be. We
were always able to find a way. Now QuickBooks installs as a standard user with no issues.
It can be done.
¯\_(ツ)_/¯
It is also now against federal law in the US, Canada and, I believe, the UK.
In the US HIPAA and the federal network security act (???) and Sarbanes-Oxley all prohibit users running as Admins. This may not specifically affect your
installation but it does show how important this is.
There is NEVER a good reason to make a user an administrator. It is only lack of technical know how that leads to this scenario. Any vendor product that
requires this is not a safe product to use in a corporate network. Malware specifically looks for this as an attack vector.
I spent three years arguing with Inuit to get there software to work. Every time they said you have to run as an admin I told them it would never be. We
were always able to find a way. Now QuickBooks installs as a standard user with no issues.
It can be done.
¯\_(ツ)_/¯

SCCM 2012 - How to add domain id to local administrator group of all clients

SCCM 2012 - How to add domain id to local administrator group of all clients
Hi,
i have a domain id sccmadmin which is a part of domain admins group too.
Need to add this ID to the local administrators group of all clients. How do I do this? Please help!

Hi ,
you need to choose the second option .
First option will remove all the domains users from the local administrator group available in all the PC'S .Then local administrator group will only have the users updated on the members list present in group policy.
Note : Local admins accounts on the local administrators groups will not be removed.
Second option will add the newly created group to the local administrator group in all the PC'S and it will not remove the existing members in the local administrators group.
Step 1 : Just try to create one new group for SCCM management .
Step 2 : Then add the SCCM account to that group.
Step 3 : Then please create a new group policy on that just choose the second option.On that option just add the newly created group to be an member of administrator group in all the PC'S
Why i have asked you to create a new group ?
Because in second option , we don't have a option to add a individual user .
Once you have created a group policy it will like below snap.
As an additional i will tell how to find the newly created group policy is applying to computer objects or not ans also i will tell you how to force update the group policy
1.gpresult /r ----> To find the which group policy is applying on user and computer object .
2.rsop.msc ----> There you can able to find the change has been applied or not .
3.gpupdate /force -----> Forcefully updating the group policy in a client machine
4.In gpmc.msc there is one option called group policy results .That option will be used for centralized management to find the policies that are applied to a user and computer account.
5.Just check the event viewer in all the PC'S for group policy related events.
Most importantly you need to make sure all the computer accounts are placed in an ou ,where the newly created group policy is applying and also make sure that OU doesn't contain any inheritance block.
Please feel free to reply me if you have any queries.
Thanks & Regards S.Nithyanandham

Grant access to modify membership of local administrator group

hello
I am active directory administrator and i like to grant a certain user access to modify membership of the local administrator group for computers in a specific OU only. i tried to do that via delegation of control to modify membership of the group,
however when he tries to modify administrators group of one computer on that ou, he gets a message with access denied. Is there a way to do that other than delegation of control.

Hi,
According to your description, you want to grant the right to modify local administrator group membership on computers which belong to one specific OU through ADUC, right?
I don’t think it is possible via delegate control, since local administrator group membership can only be modified by local administrator on the local machine, what you did only grant the right to modify the group membership of
the specific OU, which means adding/deleting members within this OU.
In other words, you need to add this user into the local administrator group on local machines to achieve your goal.
Best Regards,
Amy

Wmi script to find out the time when the user was added to local administration group

Hi Friends,
i need a script/query based on wmi/wql that find out the time when the user was added to local administration group on this computer
Regards
Tanoj
OSLM ENGINEER - SCCM 2007 & 2012

WMI does not keep security information.
Unless you have enabled auditing, this information is not retained in any way.
If auditing is enabled, you can write a powershell script to look for the specific event in the eventlog. More specifically, you should look for all security events with id 4732 containing the group.
this one command does the trick
get-eventlog -logname security -instanceid 4732 -message *administrators*
https://technet.microsoft.com/en-us/library/dd772663(v=ws.10).aspx
MCP/MCSA/MCTS/MCITP

Can not add Domain User to Local Admin Group Win8.1

Hello,
I am trying to add a domain user to the local admin account on a Win8.1 Enterprise computer. When I click the check name button it asks me to enter network credentials even though I am signed in to the computer with a domain admin account. When I try to
type in any of my domain admin accounts it says "The Username or Password is incorrect". Even though I used that same account to login with. I can successfully ping all 3 of my DCs from the computer and have tried putting my second DC as the primary
DNS and my third DC as the primary DC and same problem. I have checked for Active Directory errors on the DC and everything says it is running fine on the DC in server manager. I have this problem on multiple computers. Some of the computers it will work on
but 90% of them it won't allow me to add the local user to the local admin group.
DCs are running Win Server 2008 R2 Enterprise.
Any help would be greatly appreciated.
Thank You

I would suggest you to use Restricted Group(via GPO) to add domain users/group to a local admins group
1)Create a new group in Active Driectory
Create a new group in Active Driectory that you wish to add to every workstations local administrator group. DO NOT add any users to this group at this time.
2.
Create a new GPO
Create a new group policy object and link it to the desired OU. Make sure that the GPO you are using covers the OU that the WORKSTATIONS you are wanting to give users local administrative rights over.
3.
Edit the newly created GPO
Navigate within the newly created GPO to Computer Configuration -> Policies -> Windows Settings -> Security Settings --> Restricted Groups
4.
Add your new Active Directory group to the Restricted Group
Right-click the Restricted Groups folder and select "Add Group" to add your new Active Directory group to the Restricted Group. In the Group field, type the name of the newly created Active Directory group and click "OK"
5.
Add the Restricted Group to the local administrator group
In the Restricted Group Properties windows click "Add" under the section titled "This group is a member of:" Type "Administrators" (without the quotes and yes it is plural), in the Group Membership window and click "OK"
6.
Wait for GPO updates to apply to the workstations
Once your users receive their updated group policy settings every workstation within the OU you specified will have your new Active Directory group as a member of the local administrators group. If you need to force the GPO update on a specific workstation,
run "gpupdate /force" in a command window on that workstation.
7.
Add a user or group of users to the Active Directory Restricted Group
When you are ready, or in a position where you need to provide local workstation admin rights you can simply add the users or group of users to the Active Directory group that you created for use with Restricted Groups within your Active Directory Management
Console.

Adding users in Local Administrators Group using GP Restricted Group

Hi Experts.
I have approx 200 servers. There are user1, user2 and user3 which I have added in
Local Administrators Group using GP Restricted Group in all 200 servers. This works fine. In Add Group option I added "Administrator" and Added user1, user2 and user3 in "Members of this Group". Now all 3 users are reflected as a Local
Administrators member.
Now there is a need that user 4 should be in Local Administrators Group using GP Restricted Group for certain servers only. Lets say 50.
In Add Group option I added "Administrator" and Added user4 in "Members of this Group". BUT it doesn't work.
Any idea?
Regards Suman B. Singh

Hi,
How is it going? I agree with Martin. To do this, we can configure the setting in two different GPOs. For instance, in GPO1, we add user1, user2, and user3 to the local admin group; in GPO2, we add user1, user2, user3, and user4 to the local admin group;
and then we can use Security Filtering to apply the specific GPOs to specific computers.
Regarding security filtering, the following article can be referred to for more information.
Security filtering using GPMC
https://technet.microsoft.com/en-us/library/cc781988(v=ws.10).aspx
Filter Using Security Groups
https://technet.microsoft.com/en-us/library/cc752992.aspx
Besides, in addition to Restricted Groups, we can also use Group Policy Preferences Local Users and Groups to do this, in which way we can configure two Local Group items in one GPO and utilize Item-Level Targeting to apply the specific items to specific
computers.
Regarding GPP Local Users and Groups, the following article can be referred to for more information.
Configure a Local Group Item
https://technet.microsoft.com/en-us/library/cc732525.aspx
How to use Group Policy Preferences to Secure Local Administrator Groups
http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/
Regarding Item-Level Targeting, the following article can be referred to for more information.
Preference Item-Level Targeting
https://msdn.microsoft.com/en-us/library/cc733022.aspx
Best regards,
Frank Shen

Service accounts adding to Local admin group

Hello Everyone,
What are the risks with adding SharePoint service application service accounts to local admin group.
I see in many Microsoft blogs not to use farm account to create service application and better to use dedicated service account but i didn't see any articles why we shouldn't add dedicated service accounts to local admin group
I am facing some GPO issue and one my friend suggested to add service accounts to add local administrator group to fix this issue but i am not sure what the risks behind it.
Please let me know if you aware of risks.
Thanks S

The basic is that it increases your attack surface. If the service (and this goes for any application regardless of vendor or platform) has elevated access to the underlying system (e.g. Local Administrator, SYSTEM, root, and so forth) and that service is
compromised, there is the possibility that the entire server would be compromised.
Clearly, this is not a good situation.
Having said that, there are two scenarios where a service account in SharePoint must be a Local Administrator:
If you're running the Claims to Windows Token Service (C2WTS) as a Domain User. This account requires Local Admin.
If you're provisioning the User Profile Sync Service, the Farm Administrator account must be a Local Administrator during the provisioning process (reason being is that it makes calls to the SAM).
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Need to Query Local Admin Group

I wrote (copied) some PowerShell code that will add a Domain User to the Local Admin Group using ADSI.
$GuestPC = "WinNT://DOMAIN/UserName,user"
$AdminGroup = [ADSI]("WinNT://"+$env:COMPUTERNAME+"/administrators,group")
$AdminGroup.add($GuestPC)
I want to add an If - Else statement to check if the Domain User is already in the Administrators group.
I found this code:
$members = @($AdminGroup.psbase.Invoke("Members"))
$members | foreach {$_.GetType().InvokeMember("Name", 'GetProperty', $null, $_, $null)}
This code actually lists the members of the Administrators Group. Maybe its early or I did not get enough sleep, but I cannot figure out how to just query the Administators group for $GuestPC and if it is there don't do anything, but if it is not there
add it using the above code.
Something easy for someone out there I hope?
Matt
Matt Dillon

Finally found the answer on Google. Just need to add -cnotcontains "GuestPC" in side a If-Then
Matt Dillon

UDI Add Local Administrator and Change Local Administrator Username

I'm unable to find any information on how to either add a new local user admin account, or change the default local user admin account name during SCCM 2012 SP1 UDI OSD. The AdminAccountPage only has two areas, Local Administrator Password Text Box, and
Administrator User Accounts Text Box.
The first one, Local Administrator Password Text Box, works when I set a variable that corresponds to a password for the default local user admin named "Administrator". We'd like to change the name of this default local user admin to something
else, like "Help Desk".
The second area, Administrator User Accounts Text Box, lets me add users to the computer local administrators. We're fine adding domain users, but I'm not understanding how local users get added. Would the local user have to already exist in the reference
image? I see that the OSDAddAdmin variable will take either domain\user or computer\user. If I put in computer\user, and it's an account that doesn't already exist on the reference image, does it create a new local user account? And if so, how do you set a
password for this account?
I'd appreciate any help or advice anyone can give me. Thanks.

Is using Group Policy available to you? This would be a far easier way to add additional local accounts to your computers, rather than trying to modify the default built in local administrator account.
As an example: http://www.techrepublic.com/blog/the-enterprise-cloud/deploy-local-accounts-via-group-policy/
You would be able to provision new local accounts i.e. HelpDesk outside of Configuration Manager.
Regards
Damon

Exchange Management Console require workstation local administrative rights to run?

Does launching the Exchange Management Console require local administrative permissions?
I understand I need Exchange permissions to perform Exchange tasks, but I am wondering what permissions are required just to run the Management Console?
Jason Meyer

Hi,
If you just want to launch the EMC, you need not require any special permission.
However, if you want to modify anything, you should assign the corresponding permission to the appropriate user.
I recommend you refer to the following articles to understand the permission in exchange:
http://technet.microsoft.com/en-us/library/dd351175(v=exchg.150).aspx
AD Domain Rights Needed to Manage Microsoft Exchange 2010
Hope this helps!
Thanks.
Niko Cheng
TechNet Community Support

I need help, How could I add Aliases to Local Administrator account via terminal commands???

I need help, How could I add Aliases to Local Administrator account via terminal commands???
I want to use commands to add alias for existing administrator account remotly by using ARD.
Thanks.

Hi,
a Windows Domain Controller does not have any local user or groups. So you might add the user to the admin group at Domain level.
B RGDS,
Gregor
Edited by: Gregor Gasper on Jan 9, 2009 1:44 PM

Need to provide local administrator access without domain administrator rights

Hi All,
I need to provide local admin access to one account in windows environment without providing domain administrator rights.
Windows 2008 DC. Desktops : windows 7
So that we can use this account to install agents like SCCM\SCOM in all servers & desktops.
Need suggestions.

Hi,
I agree with Senne, in addition, we can also use net command to perform local group management.
More information for you:
Add a member to a local group
http://technet.microsoft.com/en-us/library/cc772524.aspx
How to Make a Domain User the Local Administrator for all PCs
http://social.technet.microsoft.com/wiki/contents/articles/7833.how-to-make-a-domain-user-the-local-administrator-for-all-pcs.aspx
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Add Windows 7 local administrators group to another local group

So I have the local group MyLocalGroup and I need to add the local Administrators group as member of MyLocalGroup
I'm working with Windows 7 Professional with Windows Management 4
I have tried:
[ADSI]$LocalAdmonistratorGroup="WinNT://$Env:COMPUTERNAME/Administrators,Group"
[ADSI]$MyUsersGroup="WinNT://$Env:COMPUTERNAME/MYLOCALGROUP,Group"
$MyUsersGroup.Add($LocalAdmonistratorGroup.Path)
Exception calling "Add" with "1" argument(s): "A member could not be added to or removed from the local group because the member does not exist."
BUT:
$LocalAdmonistratorGroup.Add($MyUsersGroup.Path)
It's work! And MyLocalGroup is member of administrator.
I have made some test and:
1. A user can be added to any local group (ok)
2. A local group can be member of any local group (ok)
3. A group or a user can be added to local Administrators group
4. If I try to add local administrators group as member of any other local group I receive the error!
How I can add the Local Administrators group as member of another local group using PowerShell (with interface work)?
Thanks,
Lorenzo Soncini
LSo Lorenzo Soncini Trento TN - Italy

Hi Lorenzo,
Nesting local groups (add a local group to the group membership of another local group on the same client )is not recommended.
Refer to:
Nesting of local groups is not supported on workstations or member servers
If we execute this operation via Computer Management Interface, it will produce error.
Some group authoring tools can add local Group To local Built-in Groups, however, our suggestion is to never nest local groups even when it is allowed by a group authoring tool like “net local group” because such nesting doesn’t reflect the group expansion
constraints and the end results would be different from the expected results.”
Refer to:
Nested User Groups (Groups in Groups) / Built-in Local Groups Issue
If there is anything else regarding this issue, please feel free to post back.
If you have any feedback on our support, please click here.
Best Regards,
Anna Wang
TechNet Community Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Windows 7: Trust Relationship Error - Local Administrator Account Locked.

I have 2 Windows 7 Professional machines that recently locked me out citing the "Trust Relationship between this workstation and primary domain failed".
I assumed all I would have to do is log in as local administrator and remove it from the domain and then re-add it. When I tried to log on, it told me that I have the password was incorrect - which I knew it wasn't. After a
few tries I got a different message that said that the account was locked. No idea how this could have happened. Every other local account was locked as well.
I checked the AD on our 2003 server and I didn't see anything out of the norm. The computers were in the correct OU, and were not disabled in anyway. I searched online for a solution, but they all required me to be able to log on to the local
admin, which is disabled.
I tried to boot to Safe Mode with a Command Prompt and typed in: net user administrator /active:yes .
It told me that the change had been made, but when I reboot it still shows the local account as disabled.
Any suggestions would be greatly appreciated.
Edit: It is Windows 7 Professional x64

I have had this issue twice as well. However I have been always been able to log in with local admin rights. removing then rejoining to domain seems to never get things back to normal for me. Once it is reset and joined back to the domain all software just
seems to be missing but still there at the same time. Like Antivirus shows its installed in c:\program files but its not running. If I go to domain users start menu everything is missing but go into c:\program files and its all there. So every time I have
seen this error a reimage is what I do seems to work a lot better than dealing with the head aches. Sorry I was not any help but that is my two cents.

Add Managed By AD value to Local Administrator group.

Similar Messages

Maybe you are looking for