Domain Controller Local Administrators Group

This default nesting should not be modified for supportability and disaster recovery purposes.

Domain controller local administrators group. Domain admins are by default members of the local administrators groups on all member servers and workstations in their respective domains. From menu select action new group. This permits a local branch user to log on to an rodc and perform maintenance work on the server such as upgrading a driver. One of the issues that data center or even any windows administrator has is managing the local administrators group on each and every one of their domain members.

Log onto a domain controller open active directory users and computers dsa msc create a security group name it local admin. Add the help desk members to the local admin group. I will add two users say tom and bob. There is a lovely security setting that has been around for many years restricted groups which can be controlled via local security policies of via gpo.

First you need to create a security group called local admin. The same holds true for populating the local admins group via the restricted groups feature in group policies. Name the group as local admin. As stated in the comments either method will result in adding the domain user to the domain group builtin administrators which will then grant that user administrative permissions to active directory.

Unfortunately domain controllers don t have the local users and groups databases once they re promoted to a domain controller. You cannot add a domain user account to the local administrators group on domain controllers. Depending on what your needs are you might be able to add the user or service account into the domain administrators group within active directory. You can delegate local administrative permissions for an rodc to any domain user without granting that user any user rights for the domain or other domain controllers.

Within active directory search for your builtin administrators group and add your service or user account into that.