Manage Workstations Without Domain Admin Rights
How can I manage workstations if I don’t have domain administrator rights?
It’s common that IT staff are given domain administrator rights for a number of reasons, one being that it’s a convenient way to log on to workstations with local administrator privileges. But from a security standpoint, giving high-level access to Active Directory (AD) for the sake of an easy life, puts your IT infrastructure at risk.
Create an AD group for workstation management
First we need to create a management group in Active Directory for users who will have rights to log on to workstations with administrative privileges.
- Log on to Windows Server 2012 with a user account that has rights to create AD users and groups, and create Group Policy Objects (GPO).
- Open Server Manager from the icon on the desktop Taskbar or from the Start screen.
- Select Active Directory Users and Computers from the Tools menu.
- In the Active Directory Users and Computers MMC, right-click the Users container in the left pane, and select New > Group from the menu.
- In the New Object dialog box, name the group “Workstation Administrators” and click OK.
- Make sure the Users container is selected in the left pane of the AD Users and Computers MMC and double-click the new group in the right pane. Switch to the Members tab in the properties dialog box and click Add.
- In the selection dialog box, add any user accounts that you want to give administrative access to workstations and click OK.
- Click OK in the properties dialog box.
Add the new AD group to the local Administrators group
Now I’m going to create a GPO to add the new AD group to the local Administrators group on all my workstations. I recommend that you create a separate Organizational Unit (OU) for your workstation computer accounts. While it’s possible to apply Group Policy to computer objects in the default Computers container, it would mean linking the GPO to the domain and filtering out domain controllers and member servers.
- Open Group Policy Management (GPMC) from the Tools menu in Server Manager.
- In the left pane of GPMC, expand your domain, right-click your workstations OU, and select Create a GPO in this domain, and Link it here from the menu.
- Call the new GPO “Workstation Administrators” and click OK.
- Expand your workstations OU, right-click the new Workstation Administrators GPO and select Edit from the menu.
- In the Group Policy Management Editor window, expand Computer Configuration and Preferences.
- Under Control Panel Settings, right-click Local Users and Groups, and select New > Local Group from the menu.
- In the New Local Group Properties window, click the arrow to the left of Group name: and select Administrators (built-in) from the menu. Click Add.
- In the Local Group Member dialog, click the box to the right of Name:.
- Type Workstation Administrators in the selection box and click OK.
- Click OK in the Local Member Group dialog and again in the properties dialog.
- Close the Group Policy Management Editor window.
The next time Group Policy applies to computers in the workstations OU, the AD\Workstation Administrators group will be added to the local Administrators group, enabling IT administrators to manage workstations without domain admin privileges.
More in Active Directory
Microsoft Releases Update to Streamline Exchange Online License Assignments
Jan 24, 2023 | Rabia Noureen
Microsoft Announces New Multibillion-Dollar Investment in OpenAI
Jan 23, 2023 | Rabia Noureen
How to Export Active Directory Users to CSV With PowerShell and ADUC
Jan 23, 2023 | Michael Reinders
ManageEngine ADSelfService Plus: Protect On-Premises and Cloud Services from Password Attacks with Multi-factor Authentication
Jan 12, 2023 | Michael Reinders
Microsoft 365 to Launch New $1.99/Month Basic Subscription with 100 GB of OneDrive Storage
Jan 11, 2023 | Rabia Noureen
Samsung Releases Server-Side Fixes for Microsoft Intune Android 13 Enrollment Issues
Dec 22, 2022 | Rabia Noureen
Most popular on petri