34

With Windows 10 you can join an organisation (=Azure Active Directory) and login with your cloud credentials.

Based on the information provided here the first account per computer that joins the organisation is a local administrator. The accounts that join after that are not.

How do I make them local administrators?

The standard group add dialog does not allow me to select users from AzureAD, search from users from AzureAD. I simply can see that my first account is in the list (listed as AzureAD\AccountName).

Interesting is also: When I login with the second account and get prompted for a local administrator (for applying computer settings - UAC I assume) it will not accept the first account even though it is a local administrator.

1
  • 1
    you need to change the accepted answer... Chris Angell has the simple 1-liner command line that makes everything work right
    – ckozl
    Mar 24, 2016 at 2:46

7 Answers 7

74

You can do this via command line! I just had this same issue and after searching and getting nothing but "you can't" from everywhere, I (for giggles and grins) tried this through the command line and IT WORKED!!

  1. Login to the PC as the Azure AD user you want to be a local admin. This gets the GUID onto the PC.

  2. Log out as that user and login as a local admin user.

  3. Open a command prompt as Administrator and using the command line, add the user to the administrators group. As an example, if I had a user called John Doe, the command would be net localgroup administrators AzureAD\JohnDoe /add.

Log back in as the user and they will be a local admin now.

4
  • What about filesystem permissions? Is there any way to use the GUI for filesystem permissions?
    – Monstieur
    Aug 2, 2016 at 5:37
  • You could maybe use fileacl for file permissions? Jan 11, 2017 at 19:28
  • 6
    Step 2: You don't have to log out+ log in as local admin. From any account you can open CMD as admin (it will ask for admin credentials if needed). Then next time that account logs in it will pull the new permissions.
    – Hicsy
    Aug 18, 2017 at 5:02
  • @Monstieur I created a local (user) group with no one in it (called $MYUSERNAME_user), added the AD user with the above instructions, then used the GUI to add the local group (and therefore the user) for filesystem permissions. It's a kluge, but it works. Probably not good for a widely-used system lest someone add more users to the local group, but adequate for a single-user workstation. Oct 23, 2019 at 21:01
5

I found this Microsoft document related to this question:
"Connect to remote Azure Active Directory-joined PC".

You can specify individual Azure AD accounts for remote connections by having the user sign in to the remote device at least once and then running the following PowerShell cmdlet:

net localgroup "Remote Desktop Users" /add "AzureAD\the-UPN-attribute-of-your-user"

where FirstnameLastname is the name of the user profile in C:\Users, which is created based on DisplayName attribute in Azure AD.

This command only works for AADJ device users already added to any of the local groups (administrators). Otherwise this command throws the below error. For example:

  • For cloud only user: "There is no such global user or group : name"
  • For synced user: "There is no such global user or group : name"

In Windows 10, version 1709, the user does not have to sign in to the remote device first.

In Windows 10, version 1709, you can add other Azure AD users to the Administrators group on a device in Settings and restrict remote credentials to Administrators. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices.

Please keep this sentance in mind:

In Windows 10, version 1709, the user does not have to sign in to the remote device first.

1
2

I just landed here with a similar problem - how do I add my Azure user to the local "Hyper-V Administrators" group.

Apart from the best-rated answer (thanks!), turns out you can with the following PS command as well:

PS> ([adsi]"WinNT://./Hyper-V Administrators,group").Add("WinNT://$env:UserDomain/$env:Username,user")

which I found on https://docs.okd.io/latest/minishift/troubleshooting/troubleshooting-driver-plugins.html#troubleshooting-driver-hyperv

1

Try this PowerShell command with a local admin account you already have.

Add-LocalGroupMember -Group administrators -Member AzureAD\*UPN*
1
  • With the user logged in, opened elevated PowerShell using M365 Global Admin account, run the above, user logout, login in job done!
    – golfalot
    Jan 9 at 0:07
0

My experience is also there is no option available to add a single AAD account to the local adminstrator group. What you can do is add additional administrators for ALL devices that have joined the Azure AD. You can do his through the azure console on https://manage.windowsazure.com for which you need an AAD license). You can find this option by clicking on your tenant name and click on the 'configure' tab. Look for the 'devices' section.

This means that two AAD users can not be local admin on the same device at the same time, unless one of the users is a global admin for all devices... In the case the windows machine has to change owner, that needs also local admin rights on the specific machine, you need to de-join from AAD and re-join using the new owner user account.

I tried this and to my surprise the built-in local administrator did not have permissions to join Azure AD. Clicking the button didn't give any reply. Only after adding another local administrator account and log in locally with that user I could start the join process. In the login screen I specified the Azure AD/0365 user. That one became local admin correctly.

See also the blog below:

Azure ad join windows 10

0
PS C:\WINDOWS\system32> Get-ComputerInfo | Select-Object -ExpandProperty WindowsVersion
2004
PS C:\WINDOWS\system32> net localgroup adminstrators /add "AzureAD\[email protected]"
0

Starting with the Windows 10 1709 release, you can perform this task from Settings -> Accounts -> Other users. Select Add a work or school user, enter the user's UPN under User account and select Administrator under Account type


Additionally, you can also add users using the command prompt: If your tenant users are created in Azure AD, use net localgroup administrators /add "AzureAD\UserUpn"


For the most updated version please visit: https://learn.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin#manually-elevate-a-user-on-a-device

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .