Active Directory

Manage Workstations Without Domain Admin Rights

How can I manage workstations if I don’t have domain administrator rights?

It’s common that IT staff are given domain administrator rights for a number of reasons, one being that it’s a convenient way to log on to workstations with local administrator privileges. But from a security standpoint, giving high-level access to Active Directory (AD) for the sake of an easy life, puts your IT infrastructure at risk.

Create an AD group for workstation management

First we need to create a management group in Active Directory for users who will have rights to log on to workstations with administrative privileges.

  • Log on to Windows Server 2012 with a user account that has rights to create AD users and groups, and create Group Policy Objects (GPO).
  • Open Server Manager from the icon on the desktop Taskbar or from the Start screen.
  • Select Active Directory Users and Computers from the Tools menu.
  • In the Active Directory Users and Computers MMC, right-click the Users container in the left pane, and select New > Group from the menu.
  • In the New Object dialog box, name the group “Workstation Administrators” and click OK.
  • Make sure the Users container is selected in the left pane of the AD Users and Computers MMC and double-click the new group in the right pane. Switch to the Members tab in the properties dialog box and click Add.
  • In the selection dialog box, add any user accounts that you want to give administrative access to workstations and click OK.
  • Click OK in the properties dialog box.

Add the new AD group to the local Administrators group

Now I’m going to create a GPO to add the new AD group to the local Administrators group on all my workstations. I recommend that you create a separate Organizational Unit (OU) for your workstation computer accounts. While it’s possible to apply Group Policy to computer objects in the default Computers container, it would mean linking the GPO to the domain and filtering out domain controllers and member servers.

  • Open Group Policy Management (GPMC) from the Tools menu in Server Manager.
  • In the left pane of GPMC, expand your domain, right-click your workstations OU, and select Create a GPO in this domain, and Link it here from the menu.
  • Call the new GPO “Workstation Administrators” and click OK.
  • Expand your workstations OU, right-click the new Workstation Administrators GPO and select Edit from the menu.
  • In the Group Policy Management Editor window, expand Computer Configuration and Preferences.
  • Under Control Panel Settings, right-click Local Users and Groups, and select New > Local Group from the menu.
  • In the New Local Group Properties window, click the arrow to the left of Group name: and select Administrators (built-in) from the menu. Click Add.

Using Group Policy Preferences to manage the local Administrators group

Sponsored Content

Maximize Value from Microsoft Defender

In this ebook, you’ll learn why Red Canary’s platform and expertise bring you the highest possible value from your Microsoft Defender for Endpoint investment, deployment, or migration.

  • In the Local Group Member dialog, click the box to the right of Name:.
  • Type Workstation Administrators in the selection box and click OK.
  • Click OK in the Local Member Group dialog and again in the properties dialog.
  • Close the Group Policy Management Editor window.

The next time Group Policy applies to computers in the workstations OU, the AD\Workstation Administrators group will be added to the local Administrators group, enabling IT administrators to manage workstations without domain admin privileges.

Related Topics:


Don't have a login but want to join the conversation? Sign up for a Petri Account

Comments (0)

Leave a Reply

IT consultant, Contributing Editor @PetriFeed, and trainer @Pluralsight. All about Microsoft, Office 365, Azure, and Windows Server.
External Sharing and Guest User Access in Microsoft 365 and Teams

This eBook will dive into policy considerations you need to make when creating and managing guest user access to your Teams network, as well as the different layers of guest access and the common challenges that accompany a more complicated Microsoft 365 infrastructure.

You will learn:

  • Who should be allowed to be invited as a guest?
  • What type of guests should be able to access files in SharePoint and OneDrive?
  • How should guests be offboarded?
  • How should you determine who has access to sensitive information in your environment?

Sponsored by:

Live Webinar: Active Directory Security: What Needs Immediate Priority!Live on Tuesday, October 12th at 1 PM ET

Attacks on Active Directory are at an all-time high. Companies that are not taking heed are being punished, both monetarily and with loss of production.

In this webinar, you will learn:

  • How to prioritize vulnerability management
  • What attackers are leveraging to breach organizations
  • Where Active Directory security needs immediate attention
  • Overall strategy to secure your environment and keep it secured

Sponsored by: