Adding users to the Local Administrators Group

[kachbo1]

Can anyone help with the process via group policy in which I can add a nos of users to the local Administrators group on a nos of computers.

 

[bofhrevenge2]

The only way using group policy that i'm aware of is the restricted groups policy, we use it and it works well. The only problem is that it will remove any other accounts from the local group if you don't specify them in the policy. (This is by design)

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

 

[agrappe]

Download Sanur(

http://www.commandline.co.uk/sanur)

to pipe your password to the runas command. Set a startup script to run the following in a batch file.

runas /noprofile /u:domain\administrator "net localgroup administrators domaingroupname /add" | sanur.exe password

 

[mlichstein]

Restricted groups ++

 

[SteveMCSE]

This is not a permanent change because as soon as the group policy refreshes the user is removed from the group.

Do it and then run:
secedit /refreshpolicy machine_policy /enforce
and then run:
net localgroup administrator

if you have a gpo in AD that restricts the access to this group this won't work. I've been looking for a different solution too.