up vote 1 down vote favorite
share [g+] share [fb]

The administrators aren't admins on the computers that we connect to the domain so we have to login with a local admin and upgrade peoples accounts manually. How can we make the local accounts match the domain accounts?

link|improve this question
50% accept rate
Are you using Active Directory to store all your users on a dedicated server? or do you run local accounts on every machine and create local accounts for all users? – Joe Oct 31 '11 at 22:24
@JoeSafe The AD has our users. When I (that is in the domain group administrators) log into a colleagues computer, I won't be an administrator but have to upgrade my account on that computer. – Kit Sunde Nov 1 '11 at 5:16
OK, SORRY, just to check one more thing, you don't have any local accounts created with the same name on the names? So like your username on AD is Joe, you then don't have a local account called Joe as well on that machine do you? – Joe Nov 1 '11 at 18:59
@JoeSafe No when I signed in with my AD account to the computer, it had never been used before. – Kit Sunde Nov 2 '11 at 5:53
feedback

2 Answers

up vote 1 down vote

well anyone in the Domain Admins group should be administrator on the machines, it is pretty standard to have Domain Admins in the local Administrators group, but if you handle things differently, say with a "Workstation Admins" group, then you will need to create a GPO.

These two sites may help: http://myitforum.com/cs2/blogs/rdixon/archive/2008/06/17/how-to-add-domain-accounts-to-local-administrators-group-using-gpo.aspx

http://www.windowsecurity.com/articles/securing-local-administrators-group-every-desktop.html

link|improve this answer
feedback
up vote 1 down vote

Odd.. if you login to an AD domain-joined computer with an account in the Domain Admins group, you should have administrator rights on the machine. It takes a lot of extra work to make things not happens this way. Are you sure this isn't an elevation issue (ie: windows 7 will still require you to explicitly choose to run things as administrator now)?

Look in the local administrators group on the machine and make sure that {YourDomin}\Domain Admins is a member.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.