We have a requirement for a tool to need local administrator access to all systems in the domain (security scanning tool).

Here are the steps taken so far:

  • Created an account
  • Added the account to a group called "Security Administrators"

The question we have is how do we add this group to the local "Administrators" group on all systems.

The sysadmin tried adding this to the default policy, but it ended up wiping out the existing users from the local "Administrators" group.

How can we add the account to local "Administrators" without overwriting the other accounts?

  • 1
    What exactly do you mean when you say he added it to the default policy and it trashed everything. There are a couple ways he could have done this, and one is wrong makes a mess of things, and one works perfectly.
    – Zoredache
    Commented Sep 19, 2014 at 16:48

2 Answers 2


It wiped out the contents of the Local Administrators group because when your sysadmin defined the Group Policy Preference, he chose Replace as the action to perform. That's a dangerous setting when applied to Users and Groups preferences. The correct action should be Update.

Replace causes the client to delete the contents of the Administrators group first and then add just the groups you specified in the Group Policy.

Update leaves the group alone and just adds the group you specify to the already-existing list.

NOTE: It probably got set to replace when he checked the box "Remove this item when it no longer appled." on the Common tab. Checking this box automatically changes the action to Replace. This checkbox really needs to be reworded. It doesn't do what the wording suggests.

enter image description here


This is trivial if with Group Policy preferences. On of the preferences in the computer policy is the facility to control the membership of local groups. There are many guides out on the Internet on how to use this feature, I have included a couple links to point you in the right direction. Remember, you almost certainly do not want the 'Restricted Groups', you want manage groups under the preferences section.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .