Local admin but not domain admin

[Bad boy Warrior]

Is it possible to elevate a user's right to become local admin on all PCs on a domain but not have domain admin rights?

Thanks

[awergh]

The tedious way is to add the Domain User to the Local Administrator Group on each PC but this is probably not what you had in mind?

Although if you used a Startup Script it wouldn't be so bad but it probably isn't the best approach.

Edited July 16, 2010 by awergh

[Bad boy Warrior]

The tedious way is to add the Domain User to the Local Administrator Group on each PC but this is probably not what you had in mind?

Although if you used a Startup Script it wouldn't be so bad but it probably isn't the best approach.

I wouldnt want to add the user individually to each PC. I was looking for a more convenient approach (i.e. group policy) to add the user and take them out once the tasks are completed.

[cluberti]

You can do this in group policy, yes.

[Bad boy Warrior]

You can do this in group policy, yes.

Enlighten me!! Ive searched the net and played around with some policies without much success

[cluberti]

KB Article???

[Bad boy Warrior]

Getting a bit closer here (thanks). Can i double check a couple of stuff here as it seems it will remove the existing groups contained within the LOCAL policy(as in the local PC) Administrators group...

I create a group on my domain (domain\temp)

Within the policy i right and click Add Group... and add domain temp

Under Members of this group i click Add and type Administrator (this shows up as Administrator and NOT Domain\Administrator)

The same procedure and add Domain\Admins

The same procedure and add Domain\Temp

Should this do the trick?

Thanks again

Edited July 17, 2010 by Bad boy Warrior