[smjailani]

Hi there,

We have 2000 users in our Active Directory in single domain splitted with 40 Sites. Some of the Helpdesk users want to connect the domain PCs to do some administrative functions on the PCs, At the same time i have added these users in "HDESK" DL-G group and this "HDESK" DL-G group is member of Account operators group. they have access in the domain controllers for creating, deleting user IDs and to reset their passwords.

Now i want to add this "HDESK" DL-G group in all the local PCs administrator group. so that they have administrativr right on the local PCs. is is possible to automate by GPO or script.so that i don't want to connect each pc and this group manually ??

By default "Domain Admins" group is added to the administrators group in the PC if it is connected to the domain. but i don't want help desk users to give domain admin rights because of security reasons.


Advanced Thanks

[Dumber]

I thought you can do this with restricted groups in a GPO

http://www.windowsecurity.com/articl...ed-Groups.html
http://www.windowsecurity.com/articl...ed-Groups.html

[smjailani]

Thanks a lot Dumber for your valuable solution, Thanks for the link. This is what i need to do in my domain PCs. It really helps me in solving the difficulty i had.