Our company has a .loc domain with several Windows 10 computers on it. One of the computers, let's call it ComputerA, is used by an employee with a non-administrator domain user account.

On ComputerA, we want to add a local administrator account that would not be on the domain but that could be used occasionally to install software on ComputerA only. Is this possible? I know that our solution is likely not best practice, but I'm curious if there is a way to do this.

Note that I will eventually turn over my domain administrator responsibilities to another employee.

Because our company and its IT processes are very slow-moving, installing a small tool on ComputerA (necessitating that a domain administrator account logon to the computer to approve the install) would result in such a headache of time and effort that it would make it not even worth it.

  • 1
    Why not use a domain user account that's a member of the local Administrators group? Why does it have to be a local group? (A domain account is easier to manage) Sep 19 '19 at 23:50
  • 1
    Every version of Windows has a built-in Administrator account. You could just use that, but I totally agree, create a domain user and make it part of the local Administrator user group
    – Ramhound
    Sep 20 '19 at 1:12
  • "Why does it have to be a local group"--I meant "local user". Sep 20 '19 at 23:43
  • What version of Windows is running. You don't mention if the machine is in fact joined to the domain although I would assume it is but please clarify this.
    – Brad
    Dec 9 '20 at 19:43
  • As stated in the title, the machine is running Windows 10 and yes it is on the domain ("Windows 10 computer on .loc domain")
    – ninja star
    Dec 10 '20 at 0:14

I discovered how to do this:

  1. Open Computer Management as an administrator
  2. Go to System Tools - Local Users and Groups - Users
  3. Right click to Add New User
  4. When the new user has been created, right click on that user and select Properties
  5. Select Member Of tab
  6. Click Add button
  7. Click the Advanced button
  8. Click the Find Now button
  9. Choose the target local administrator group name
  10. Click Ok


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.