1

The administrators aren't admins on the computers that we connect to the domain so we have to login with a local admin and upgrade peoples accounts manually. How can we make the local accounts match the domain accounts?

4
  • Are you using Active Directory to store all your users on a dedicated server? or do you run local accounts on every machine and create local accounts for all users?
    – user95184
    Oct 31, 2011 at 22:24
  • @JoeSafe The AD has our users. When I (that is in the domain group administrators) log into a colleagues computer, I won't be an administrator but have to upgrade my account on that computer.
    – Kit Sunde
    Nov 1, 2011 at 5:16
  • OK, SORRY, just to check one more thing, you don't have any local accounts created with the same name on the names? So like your username on AD is Joe, you then don't have a local account called Joe as well on that machine do you?
    – user95184
    Nov 1, 2011 at 18:59
  • @JoeSafe No when I signed in with my AD account to the computer, it had never been used before.
    – Kit Sunde
    Nov 2, 2011 at 5:53

2 Answers 2

1

well anyone in the Domain Admins group should be administrator on the machines, it is pretty standard to have Domain Admins in the local Administrators group, but if you handle things differently, say with a "Workstation Admins" group, then you will need to create a GPO.

These two sites may help: http://myitforum.com/cs2/blogs/rdixon/archive/2008/06/17/how-to-add-domain-accounts-to-local-administrators-group-using-gpo.aspx

http://www.windowsecurity.com/articles/securing-local-administrators-group-every-desktop.html

1

Odd.. if you login to an AD domain-joined computer with an account in the Domain Admins group, you should have administrator rights on the machine. It takes a lot of extra work to make things not happens this way. Are you sure this isn't an elevation issue (ie: windows 7 will still require you to explicitly choose to run things as administrator now)?

Look in the local administrators group on the machine and make sure that {YourDomin}\Domain Admins is a member.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .