add user to local admin group

Q. 1. I want to add one specific domain user to local admin. group in winxp
system. When i join one winxp systems to the domain , a specific domain user
should be added to local admin group in winxp systems automatically, but it
should not apply on servers,

Q.2. and when i join systems to the domain, systems should be go in a
specific OU rather than computers folder in active directory users and
computers,

Thanks ,

Vijay

Hello Vijay,

Use restricted groups for that, see:
http://www.frickelsoft.net/blog/?p=13

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Q. 1. I want to add one specific domain user to local admin. group in
> winxp system. When i join one winxp systems to the domain , a
> specific domain user should be added to local admin group in winxp
> systems automatically, but it should not apply on servers,
>
> Q.2. and when i join systems to the domain, systems should be go in a
> specific OU rather than computers folder in active directory users and
> computers,
>
> Thanks ,
>
> Vijay
>

Agree with Meinolf...

If you want them to be local admins so they can perform maintenance than you
should consider using restricted groups:

To use the restricted user group gpo setting


computer configuration \ windows settings \ restricted groups


group = your group to be made local admins
member of = BUILTIN\Administrators


http://www.windowsecurity.com/articl...ed-Groups.html


http://www.microsoft.com/technet/pro...ver2003/librar...


http://www.microsoft.com/resources/d...s/xp/all/prodd...


There is absolutely nothing that has to be done on the client side.


Create the gpo in the ou where the Computers reside (NOT the users), go to
computer configuration/windows settings/security settings/restricted groups,
right click on restricted groups and select new group (For the local
computers, this group name should be - administrators) and key in the group
you want auto populated. Select add on the Members of this group and then
add the members you want populated.


Note: Be aware that the higher you place this setting within the domains
group policy the possibility exists it is applied to machines you may not
want it applied to. With this in mind you should try and avoid this setting
at the domain level, with the exception on the domain admins group. We have
some users who are local admins on machines and for some reason they feel
compelled to remove the domain admins from their local administrators group.
Setting this at the domain level manages these annoying users.




--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.

"Vijay" <Vijay@discussions.microsoft.com> wrote in message
news:FF2AF35F-D548-42AD-B5B9-84B4F360EAA8@microsoft.com...
> Q. 1. I want to add one specific domain user to local admin. group in
> winxp
> system. When i join one winxp systems to the domain , a specific domain
> user
> should be added to local admin group in winxp systems automatically, but
> it
> should not apply on servers,
>
> Q.2. and when i join systems to the domain, systems should be go in a
> specific OU rather than computers folder in active directory users and
> computers,
>
> Thanks ,
>
> Vijay
>
>
>