Is "Administrators" refer to domain group or local group?

Windows Server 2008 R2 sp1
using "Restricted Groups", i'm trying to add a domain group to be a member of all workstation's local admin group. i went and did that and use the "Member of" (so that i don't overwrite the existing local admin members) but before i hit
on "Apply", it occurred to me, does the "Administrators" group refer to the domain group or the local group?

> so i tried searching (instead of just typing it) for the
> "Administrators" group and it gave below:
As long as you do this on a domain controller, it will resolve to
domain\administrators. If you do the same (or edit this GPO) on a
member, it will resolve to computer\administrators.
And if you VIEW the GPMC settings report, it will simply show
"Builtin\Administrators".
It's only a matter of search scope :)
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Similar Messages

Remotely add Domain User to local group

I've been playing with this for some time, and I seem to be missing something. I am trying to develop a script that reads and XML file containing a list of computers, local groups, and names of domain users (and computers) to be added to the local
groups. I would like to be able to run this from a management workstation.
I've been working from these two posts.
http://blogs.technet.com/b/heyscriptingguy/archive/2010/08/19/use-powershell-to-add-domain-users-to-a-local-group.aspx
http://blogs.technet.com/b/heyscriptingguy/archive/2008/03/11/how-can-i-use-windows-powershell-to-add-a-domain-user-to-a-local-group.aspx
It appears that the command $objGroup = [ADSI]("WinNT://atl-fs-001/Administrators") only works locally. I have not been able to figure out any format that allows me to get the information remotely. So I figured I would use Invoke-Command
to execute the two lines of code remotely.
Invoke-Command -ComputerName RemoteServer {
$de = [ADSI]"WinNT://RemoteServer/Administrators,Group"
$de.psbase.invoke("Add",([ADSI]"WinNT://Domain/User").path)
(I am trying it first with fixed, valid values - change to variables when I get things figured out.) That gave me the error:
Exception calling "Invoke" with "2" argument(s): "Number of parameters specified does not match the expected number."
+CategoryInfo :NotSpecified: (:) [], MethodInvocationException
+FullyQualifiedErrorID :DotNetMethodTargetInvocation
+PSComputerName :RemoteServer
I need help on what to try next.
Thanks.
. : | : . : | : . tim

I've been playing with this for some time, and I seem to be missing something. I am trying to develop a script that reads and XML file containing a list of computers, local groups, and names of domain users (and computers) to be added to the local
groups. I would like to be able to run this from a management workstation.
I've been working from these two posts.
http://blogs.technet.com/b/heyscriptingguy/archive/2010/08/19/use-powershell-to-add-domain-users-to-a-local-group.aspx
http://blogs.technet.com/b/heyscriptingguy/archive/2008/03/11/how-can-i-use-windows-powershell-to-add-a-domain-user-to-a-local-group.aspx
It appears that the command $objGroup = [ADSI]("WinNT://atl-fs-001/Administrators") only works locally. I have not been able to figure out any format that allows me to get the information remotely. So I figured I would use Invoke-Command
to execute the two lines of code remotely.
Invoke-Command -ComputerName RemoteServer {
$de = [ADSI]"WinNT://RemoteServer/Administrators,Group"
$de.psbase.invoke("Add",([ADSI]"WinNT://Domain/User").path)
(I am trying it first with fixed, valid values - change to variables when I get things figured out.) That gave me the error:
Exception calling "Invoke" with "2" argument(s): "Number of parameters specified does not match the expected number."
+CategoryInfo :NotSpecified: (:) [], MethodInvocationException
+FullyQualifiedErrorID :DotNetMethodTargetInvocation
+PSComputerName :RemoteServer
I need help on what to try next.
Thanks.
. : | : . : | : . tim
The ADSI commands work remotely as long as you are an administrator on the domain.
Invoke-Command only works on systems set up for WinRM remoting and if you are an Administrator on the domain.
Normally we would use AD and GP to add users to local groups.
Your script is also incorrect. Thisis the correct template.
$remotepc='somepc'
$de=[ADSI]"WinNT://$remotepc/Administrators,Group"
$de.Add("WinNT://Domain/User")
You should never the user to the admin group. It is a formula for disaster.
¯\_(ツ)_/¯

Fail to add domain user into local group - RPC server unavailable

Hi all,
I have a server-1 which is join to domain A. I need to add a domain user from domain B to my server-1 local group. I keep getting "The RPC server is unavailable" error message.
But i try to use another server-2 which also belong to domain A and same network segment as server-1, i do not encounter this error while adding domain B user onto it.
The problematic server-1 is a Windows 2008 R2 SP1 server. It is install with IIS and MS SQL database 2008.
Just one thing i am guessing whether is it the cause of the problem. Before server-1 join to domain A, i did not disable windows firewall. I disable it only recently. Could this has cause the problem on my server-1?

Let's recap to make sure I understand exactly what you have going on:
- Server 1 and Server 2 are both on Domain A and in the same site, behind the same firewalls
- Adding a user from Domain B works on Server 1 but not Server 2.
- You get an RPC error while adding Domain B's user on Server 2.
Is Domain B on the other end of some firewall?
- Can you do a portqry to a DC in Domain B from Server 2 (http://www.microsoft.com/en-us/download/details.aspx?id=17148)
- Run this command: portqry -n <DomainBFQDN> -p both -o 53,135,389,3268
- We are testing DNS, RPC, LDAP and GC. Do you see anything come back as filtered or not listening?
- Do the same thing from Server 1 and compare the results.
This sounds like a connectivity problem.
Chris Ream

Domain change from Local

Hi all,
I recently installed a BI test server locally and now what to include it in the domain, can you please point out how I should go about doing this?
Thanks,
Iqbal

Hi Alex:
Yes, you can change the current installation from Local to Domain based; I don't think there's a document to perform that; do the following:
1) Create both the Service Account and the <SID>ADM users on the DC.
2) Add the computer has a member of the new domain and logon with the new domain user <SID>ADM to create the domain user profile in the server. The logoff and logon with the local <SID>ADM now copy the current user profile to the new domain based; that is to have all environment variables in the new domain user. You can do this from My Computer (right click)
3) Add the users account from the domain as a member of the local Administrators and any SAP (global and local) groups in the local server.
4) Shutdown the SAP instance and DB instance; I assume you are running MSSQL Server 2000.
5) Shutdown the SQL Server services.
6) Now open Services.msc and search for the SAP services; double click on it and go to Logon tab and change the account from LOCAL to DOMAIN based; I will suggest browsing within the new domain to find the user IDs.
7) Repeat each step for every SAP instance service and for the SQL services if they are configured with the Local SAP accounts.
8) Start DB and SAP
I think that's all!
BTW; have a current backup always!!!
Hope this helps!
Best Regards,
Federico G. Babelis
NetWeaver Certified Consultant
http://www.gazum.com

VBS: Add domain user and group to local administrators

I have a piece of VBS code that I have modified that basically adds a specified domain user and group to the PCs local Administrators group. It works on Windows 7, but not on Windows 8 at all.
Call AddUserToGroup("./Administrators", "myDomain.net/NetworkAdminis")
Call AddUserToGroup("./Administrators", "myDomain.net/Domain Admins")
Call addDomainUser("myDomain", "myUserGroup")
Sub AddUserToGroup(local, domain)
Dim objLocalGroup
Dim objDomainGroup
Dim server
For Each server in servers
Set objLocalGroup = GetObject("WinNT://" & local & ",group")
Set objDomainGroup = GetObject("WinNT://" & domain & ",group")
With objLocalGroup
.Add(objDomainGroup.AdsPath)
.SetInfo
End With
Next
Set objLocalGroup = Nothing
Set objDomainGroup = Nothing
End Sub
Sub addDomainUser(strDomain, strUser)
Dim strComputer
Dim objWshNet
Dim objGroup
Dim objUser
Set objWshNet = CreateObject("WScript.Network")
strComputer = objWshNet.ComputerName
Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators,group")
Set objUser = GetObject("WinNT://" & strDomain & "/" & strUser & ",user")
If Not objGroup.IsMember(objUser.ADsPath) Then
objGroup.Add (objUser.ADsPath)
End If
Set objWshNet = Nothing
Set objGroup = Nothing
Set objUser = Nothing
End Sub
I have debugged the code line by line using VBA's IDE and there seems to be no error condition firing. It executes all lines, but it is not adding the users and groups as it did with Windows 7 and below. The script is being run as local administrator.

Hi,
The first step is to comment out your On Error Resume Next line and try again.
Don't retire TechNet! -
(Don't give up yet - 13,225+ strong and growing)

Group policy - restricted groups. How to specify a -local- user as member of the administrators group in group policy

Hi
With restricted groups I can specify the end user -domain- accounts that are members of the local administrators group on domain PCs. But - I need a particular LOCAL account on all the machines to keep its membership of the local administrators group for testing reasons. At the moment restricted groups is striping this local account of its admin access.
Is it possible to specify a -local- computer account as admin on all the PCs via group policy or it can only be done with domain accounts?
thanks

You are asking for local accounts to be managed via "Restricted Groups".
Yes, it is possible.
Rajesh showed you one way with domain groups. In his version "Administrators" group will only contain those accounts
that are specified in the GPO, no manually added accounts. This is not always desired.
If you wish to have an account (group or user, local or domain) to be added to "Administrators" group while keeping all the other
members, proceed like this:
- create the local account on the client(s)
- in the GPO select "Add Group" in "Restricted Groups".
- type in the name of the local account, e.g. "TestID"
- in the appearing dialogue choose "This group is a member of" => Add
- type in "Administrators"
Link the GPO and that's all.
The original MS description for "Restricted Groups".is here:
http://support.microsoft.com/kb/279301/en-us
Another nice one here:
http://www.frickelsoft.net/blog/?p=13
Besides that, a great solution to manage local accouts is GP Preference Extension "Local Users and Groups".
You can simply create a "Local Users and Groups" Item (computer or user based) and specify the needed options.
http://technet.microsoft.com/en-us/library/cc731972.aspx
Of course you need some prerequisites (at least one Vista or Winows 2008 for management and the GPP CSE on each target machine).
If you are new to GPP, these links will help you to get into it:
http://www.microsoft.com/DOWNLOADS/details.aspx?familyid=42E30E3F-6F01-4610-9D6E-F6E0FB7A0790&displaylang=en
http://support.microsoft.com/kb/943729/en-us
http://technet.microsoft.com/en-us/library/cc732027.aspx
http://technet.microsoft.com/en-us/library/cc731892(WS.10).aspx
Patrick

Adding a domain user to Local Admin Groups using MDT 2012

I don't know if this will help anyone, but it did me after weeks of searching. If you are trying to add a domain user or domain groups to the local administrators group using MDT, simply go to the cs.ini and add "SkipAdminAccounts=No".
But the administrators accounts page will only appear if you choose to join a domain.

Correct, if you were to go into the %DeployRoot%\Scripts\DeployWiz_Definition_ENU.xml file you would see the entry for the DeployWiz_AdminAccounts.xml page as follows:
<Pane id="AdministratorAccounts" reference="DeployWiz_AdminAccounts.xml">
<Condition><![CDATA[ UCase(Property("SkipAdminAccounts")) = "NO" and UCase(Property("DeploymentType"))<>"REPLACE" and Property("DeploymentType")<>"CUSTOM" and Property("JoinDomain") <> "" ]]></Condition>
</Pane>
Most Wizard Pages are displayed by default, and you can turn them off by using the SkipXxxXxxxxx Page variable to hide them during wizard execution. This page is different, since it was added for MDT 2012, the MDT team decided to leave it *OFF* by default,
instead you must explicitly turn off the SkipAdminAccounts variable by setting it to "NO".
Additionally, you would not need to display this page if you were running a Refresh or a Custom Task Sequence.
Finally, this page does not actually *create* accounts, instead it just adds pre-existing user accounts and adds them to the local Administrators group. This scenario is only valid when you are joining the machine to a domain, so you must Join to the Domain.
If you are interested in adding other local users to the Administrators Group, you should write a script to create the account(s) and add them to the local group. Windows 8.1 has some *gotchas* that have to do with Microsoft Accounts, but that's a different
Story :^).
Keith Garner - keithga.wordpress.com

Find workstations with specific group in local administrators group

Hello,
Is there a simple script that will search the workstations in a domain looking for the existence of a specific domain group nested in the local administrators group ? Our desktop group can up with the idea of using domain groups nested in the local
admin group to grant administrator privileges to specific computers. They can list the members of the domain group easily but they have no easy way to know on what workstations they have added the group to. Output I am looking for is simply a list
of computers that have the specific group in the administrators group. Any advice would be appreciated.
Bobby

Thisis donethrough Group Policy. It is a special aspect of gP to set and mamintain groups on local machines. You can protect a machine fromchanges and allow users to be added and removed.
If you are just look ing to list tehcontents o a local group then get the module "Local Administration" in the Repository. It has all of the tools you need.
You can also use WMI to retrieve Group memmbership.
¯\_(ツ)_/¯

ADMT share domain local groups access denied

Hi,
I have encountered strange behavior when migrating share with permissions. This is the situation:
1) We have migrated groups from source domain(these groups are used for defining access to shares, users are directly members of these, no nested groups), groups are domain local
2) We have migrated share and reapplied and verified ACLs, ok so far
The problem is that users from source domain cannot access share migrated to new domain, accordin to ACL they have access BUT when they try access the share it only shows access denied. But when the groups are converted to Global in source domain(no need
to convert in target domain) access is permitted according to ALC).
Can someone explain that please? Thank you.
Pete
sfs

Hi,
Member permissions in domain local group can be assigned only within the same domain as the parent domain local group.
Domain local groups can contain users from any domain. They are used to assign permissions to resources. When you restructure domains, you must migrate domain local groups when you migrate the resources to which they provide access, or you must change the
group type to universal group.
For more detail information, you could refer to:
http://blog.thesysadmins.co.uk/admt-series-7-group-account-migration-wizard.html
Regards.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

SCCM 2012 - How to add domain id to local administrator group of all clients

SCCM 2012 - How to add domain id to local administrator group of all clients
Hi,
i have a domain id sccmadmin which is a part of domain admins group too.
Need to add this ID to the local administrators group of all clients. How do I do this? Please help!

Hi ,
you need to choose the second option .
First option will remove all the domains users from the local administrator group available in all the PC'S .Then local administrator group will only have the users updated on the members list present in group policy.
Note : Local admins accounts on the local administrators groups will not be removed.
Second option will add the newly created group to the local administrator group in all the PC'S and it will not remove the existing members in the local administrators group.
Step 1 : Just try to create one new group for SCCM management .
Step 2 : Then add the SCCM account to that group.
Step 3 : Then please create a new group policy on that just choose the second option.On that option just add the newly created group to be an member of administrator group in all the PC'S
Why i have asked you to create a new group ?
Because in second option , we don't have a option to add a individual user .
Once you have created a group policy it will like below snap.
As an additional i will tell how to find the newly created group policy is applying to computer objects or not ans also i will tell you how to force update the group policy
1.gpresult /r ----> To find the which group policy is applying on user and computer object .
2.rsop.msc ----> There you can able to find the change has been applied or not .
3.gpupdate /force -----> Forcefully updating the group policy in a client machine
4.In gpmc.msc there is one option called group policy results .That option will be used for centralized management to find the policies that are applied to a user and computer account.
5.Just check the event viewer in all the PC'S for group policy related events.
Most importantly you need to make sure all the computer accounts are placed in an ou ,where the newly created group policy is applying and also make sure that OU doesn't contain any inheritance block.
Please feel free to reply me if you have any queries.
Thanks & Regards S.Nithyanandham

Add Windows 7 local administrators group to another local group

So I have the local group MyLocalGroup and I need to add the local Administrators group as member of MyLocalGroup
I'm working with Windows 7 Professional with Windows Management 4
I have tried:
[ADSI]$LocalAdmonistratorGroup="WinNT://$Env:COMPUTERNAME/Administrators,Group"
[ADSI]$MyUsersGroup="WinNT://$Env:COMPUTERNAME/MYLOCALGROUP,Group"
$MyUsersGroup.Add($LocalAdmonistratorGroup.Path)
Exception calling "Add" with "1" argument(s): "A member could not be added to or removed from the local group because the member does not exist."
BUT:
$LocalAdmonistratorGroup.Add($MyUsersGroup.Path)
It's work! And MyLocalGroup is member of administrator.
I have made some test and:
1. A user can be added to any local group (ok)
2. A local group can be member of any local group (ok)
3. A group or a user can be added to local Administrators group
4. If I try to add local administrators group as member of any other local group I receive the error!
How I can add the Local Administrators group as member of another local group using PowerShell (with interface work)?
Thanks,
Lorenzo Soncini
LSo Lorenzo Soncini Trento TN - Italy

Hi Lorenzo,
Nesting local groups (add a local group to the group membership of another local group on the same client )is not recommended.
Refer to:
Nesting of local groups is not supported on workstations or member servers
If we execute this operation via Computer Management Interface, it will produce error.
Some group authoring tools can add local Group To local Built-in Groups, however, our suggestion is to never nest local groups even when it is allowed by a group authoring tool like “net local group” because such nesting doesn’t reflect the group expansion
constraints and the end results would be different from the expected results.”
Refer to:
Nested User Groups (Groups in Groups) / Built-in Local Groups Issue
If there is anything else regarding this issue, please feel free to post back.
If you have any feedback on our support, please click here.
Best Regards,
Anna Wang
TechNet Community Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Managing membership of local group - Domain Local groups not permitted?

Hi all
I would like to populate the membership of the local Administrators group on certain member servers using the "Local users and groups" feature of GPP. The object picker does not let me choose groups with Domain Local scope.
Does anyone know the reason for this? Is there any workaround?
I can add domain local groups to the membership of the Adminstrators group manually, so it seems strange I can't do it via GPO.
Alexei

> I would like to populate the membership of the local Administrators
> group on certain member servers using the "Local users and groups"
> feature of GPP. The object picker does not let me choose groups with
> Domain Local scope.
I cannot confirm. I can add both DL and GG. What OS are you using? Here:
Win 7 Enterprise 32 bit.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Domain local groups with members from other (same forest) domains?

I'm confused about granting access to a share via a domain local group that contains members from other domains. Consider this scenario:
Joe Smith logs into his own domain (DALLAS.CORP.COM) and his token gets the DALLAS\sales global group.
A share (named sales) in a different domain within the same forest (FORTSMITH.CORP.COM) assigns ntfs modify on its DACL via the FORTSMITH\sales_modify domain local group, which contains the DALLAS\sales global group.
Joe goes to access the sales share...what happens, exactly?
Since Joe logged into a DC in the DALLAS domain (outside the replication scope of the sales_modify group), his token does not contain sales_modify, right? So when he goes to access the sales share, that file server in FORTSMITH checks his token, doesn't
see FORTSMITH\sales_modify in his token, and boom: access denied...right?

Universal group is ok within the same forest but different domain.
Domain local is ok between separate forest (Trust should be in place).
Global is ok for same domain.
See this for more details.
http://msmvps.com/blogs/acefekay/archive/2012/01/06/using-group-nesting-strategy-ad-best-practices-for-group-strategy.aspx
Written by Ace Fecay-DS MVP.
Regards~Biswajit
Disclaimer: This posting is provided & with no warranties or guarantees and confers no rights.
MCP 2003,MCSA 2003, MCSA:M 2003, CCNA, MCTS, Enterprise Admin
MY BLOG
Domain Controllers inventory-Quest Powershell
Generate Report for Bulk Servers-LastBootUpTime,SerialNumber,InstallDate
Generate a Report for installed Hotfix for Bulk Servers

Add custom local group with similar power as Windows BUILTIN\Administrators group

In windows 7 or windows 8
Is there any possibility to create a custom Local group having the same power/privileges as it does the BUILTIN\Administrators group.
If yes; how?
For instance: I created a new local group, then in Local Security Policy(secpol.msc) \Security Settings\Local Policies\User Rights Assignments I added all the available policies where the Administrators group was also there, then I create a normal
local user and assigned this new customized group, however the user never obtained the sufficient power as it does a user from Administrators group.
Can anyone help?
Thanks in advance.

I don't think you can create a replica for Admin group.
Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.

Members of Domain Local Groups not showing up through net group command

Hello,
I am trying to get the list of members in a Domain Local Group using "NET GROUP" command, but unable to get the member list.
I get the message "group not found", whereas members of Global Groups are visible.
Thank you in advance !

Unfortunately your post is off topic here, in the TechNet Site Feedback forum, because it is not Feedback about the TechNet Website or Subscription.
This is only one forum among the many that are on the TechNet Discussion Forums, and given your post, you likely chose the wrong forum.
This is a standard response I’ve written up in advance to help many people (thousands, really.) who post their question in this forum in error, but please don’t ignore it.
The links I share below I’ve collected to help you get right where you need to go with your issue.
For technical issues with Microsoft products that you would run into as an
end user of those products, one great source of info and help is
http://answers.microsoft.com, which has sections for Windows, Hotmail, Office, IE, and other products. Office related forums
are also here: http://office.microsoft.com/en-us/support/contact-us-FX103894077.aspx
For Technical issues with Microsoft products that you might have as an
IT professional (like technical installation issues, or other IT issues), you should head to the TechNet Discussion forums at
http://social.technet.microsoft.com/forums/en-us, and search for your product name.
For issues with products you might have as a Developer (like how to talk to APIs, what version of software do what, or other developer issues), you should head to the
MSDN discussion forums at http://social.msdn.microsoft.com/forums/en-us, and search for your product or issue.
If you’re asking a question particularly about one of the Microsoft Dynamics products, a great place to start is here:
http://community.dynamics.com/
If you really think your issue is related to the subscription or the TechNet Website, and I screwed up, I apologize!
Please repost your question to the discussion forum and include much more detail about your problem, that could include screenshots of the issue (do not include subscription information or product keys in your screenshots!), and/or links to the problem
you’re seeing.
If you really had no idea where to post this question but you still posted it here, you still shouldn’t have because we have
a forum just for you! It’s called the Where is the forum for…? forum and it’s here:
http://social.msdn.microsoft.com/forums/en-us/whatforum/
Moving to off topic.
Thanks
MSDN and TechNet Subscriptions Support
Did Microsoft call you out of the blue about your computer?
No, they didn't.

Is "Administrators" refer to domain group or local group?

Similar Messages

Maybe you are looking for