I want to know if it is possible to give a standard user the rights to add users to a specific local users group on a windows 7 pc

This group has the right to log on locally and we want the equipment user to be able to add new domain users to that group.

I don't want the equipment users to be administrators as we have strong segregation of duties requirements. But this elevated permission would easily be defensible.

1 Answer 1


No, you can't do this. You can however add a usergroup to a usergroup, meaning that every user in that usergroup automatically becomes a member of that other usergroup.

For example, if your usergroup is named "MyApplication" you can grand the Users or DomainUsers and even the Everyone usergroup permission to this MyApplication group, and every user in that group can then automatically do whatever this group normally can do.

  • I was afraid of that. It is only one or to users from the domain that they should be able to add, so that solution wont help me. I wonder if a script can be written that can run as admin where the new users are passed as an argument that then puts them in the group...
    – DavyGravy
    Jul 1, 2017 at 20:05
  • If it is only one or two users, then you should definitely keep the administration to the domain admins (you). At the computer(s) you add a domain security group to that group, and you can then manage these yourself. They call you, you open Active Directory on the domain, add the users to the domain group, and the local computer automatically takes over the next time they login. Alternatively, consider a shared user account and setup permissions for that user on that pc.
    – LPChip
    Jul 1, 2017 at 20:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .