I've searched low and high, but I can't find anywhere that shows how to set an AD admin account that can run programs as admin but not be a domain admin in AD.

These accounts will be elevated account for shells in Powershell on the Domain Controller.

Sorry of this is a really 'User' question.

Thanks in advance.


Server 2012

  • Your question does not make sense. An AD Administrator would trump any permission a local Administrator might have. If you want user to be part of the local Administrator group then you need to add that user group. If you want to use a local Administrator account then you would have not not prefix/indicate the domain when you log into the user thus using a local profile. What you want to do does not make sense, why do you want to run as a local administrator, instead of an AD administrator? – Ramhound Aug 21 '17 at 15:39
  • I dont' want to be able to make changes to the domain but still be able to run PowerShell as admin, due to some of the Scripts we have to run, having a local account would bind us to a single machine which renders it useless for the purposes we need. – David Golding Aug 21 '17 at 15:47
  • So create a new user group with only the permission you require to run the script. You don't indicate which permissions the script requires, so the best I can do, is suggest a new user group. – Ramhound Aug 21 '17 at 15:51
  • It will be different scripts that will require different things but the main issue is how to create an admin account that doesn't have domain admin creds. – David Golding Aug 21 '17 at 15:53

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.