How do I add another local admin group on new machines??

[unclerico]

Whenever I join a machine to my domain, the Domain\Domain Admins group is added to the Administrators group on the local machine. How can I make it so that when machines get added to the domain both the Domain\Domain Admins group and the Domain\Help Desk group get added to the local Administrator group?? Hope this makes sense. Thanks.

 

[nsanto17]

I think this can be via Group Policy...

I am not sure if this is only a option on 2k3 or 2k but I have done it before.

 

[unclerico]

If this is a GPO, can someone nudge me in the direction of the Key to look for?? thanks.

 

[adcfaq]

use net localgroup localgroupname %username" /add, u might check net help localgroup for syntax.

------------------------------------
Directory Services/Exchange Consultant

 

[unclerico]

benlu, thanks for that, however, I keep getting "System Error 5 has occurred. Access is denied". My syntax is as follows:

net localgroup Administrators "Domain\Help Desk" /add

Any ideas?? Thanks.

 

[adcfaq]

u need to logon that box as admin to add any user acount into local admin group.

------------------------------------
Directory Services/Exchange Consultant

 

[hartlen]

you can write a vb script to do this

strComputer ="computername"
Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators,group")
Set objUser = GetObject("WinNT://domain/groupname, group")
objGroup.Add(objUser.ADsPath)

this is not a login script ,you can execute it with the domain admin account .

 

[unclerico]

thanks benlu and hartlen, although I don't think that this will solve my problem. What I would like is for the Domain\Help Desk group to be added to the local administrators group on the client machine without anyone from the Domain\Help Desk group needing to first log on as an admin because that would defeat what I am trying to accomplish. I have tried to use Restricted Groups in Group Policy and it worked for the most part except the Domain\Help Desk group got added to the Builtin - Administrators group in AD which I did not want to happen. This is supposed to accomplish two things:
1) I have build a custom console (using Taskpad views) so that the Help Desk group can reset passwords and unlock user accounts. The way it is set up currently works for this portion because the Help Desk group can only perform those tasks and only on the specified OU's.
2) I need for the Help Desk group to be configured as local admins for when they go to users work areas and troubleshoot issues with the pc's. When I got this functionality to work by using Restricted Groups it superceded my security restrictions on #1 above and allowed the Help Desk group to do anything that they wanted with the custom console.

I am probably just babbling on and on, but I am hoping that there is a solution to this one. Thanks a lot.

 

[emozley]

Can you just not make the Helpdesk security group a member of the Local Administrators security group in AD or failing that make the Helpdesk security group a member of the builtin Administrators group? Anyone then logging onto a PC as a Helpdesk user would then have total control over the machine without having to be set up as a user on the PC.

 

[unclerico]

emozley, that is what I did with the Restricted Groups GPO that I created...it worked, however, it also let the Help Desk group do what ever they wanted in AD as opposed to being locked down to only do password resets and unlocking accounts. Maybe I missed something??

 

[tubbaguts]

Use can create a security template that can have the users you want added to the local admin group. Once you create the template you can put it in a GPO that is assigned to the OU with the machines you want.

 

[unclerico]

tubbaguts and the rest thanks for your help but I think I have it figured out, well maybe. I created a test OU and placed a single machine inside of it...I created a GPO under Computer Configuration | Windows Settings | Scripts | Startup and created a script to do the following:

net localgroup Administrators "Domain\Help Desk" /add

It works beautifully. I had tried this before (as posted earlier) and it didn't work, however, in researching this further I found out that NTFRS replication was not functioning correctly so none of the changes being made were replicating between both DC's. I have since fixed the replication issue and everything is working beautifully. If anyone can think of security issues or performance issues or anything else about my method please let me know. Thanks.