We have domain environment and we have IT support team , I want to delegate installation rights to specific group (that particular group must have installation rights to all computers which is the part of domain). Thanks in Advance Vinay Kumar Vishwakarma


Domain Admins is added to the local administrators group on all machines joined to the domain. Add them to that.


If you don't want to add the IT support team to Domain Admins, create a new group for them and use Group Policy to add that group to the Administrators group on the local machines.

If the contents of the Administrators group on the clients can be tightly controlled, you can use the Restricted Groups policy item. Otherwise, configure a startup script:

net localgroup Administrators /add it-support-team
  • I think we need to create a security group "IT_SUPPORT" and add all IT support users to that group. And add the below following lines in the script - ifmember "IT_SUPPORT" if not errorlevel 1 goto itsupport net localgroup administrators %username% /add :itsupport
    – user128364
    Jul 27 '12 at 2:37
  • The net localgroup command won't do any harm if the group is already a member of Administrators, so testing first is a waste of time IMO. The %username% has nothing to do with it and definitely shouldn't be in the command. Also, note that since you only need to issue a single command, you don't need an actual script. Jul 27 '12 at 4:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.