Windows Forum

Ask something
Discussion Locked

User permissions in Active Directory

0 helpful
8 replies

by kennethaj 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

This is probably a simple one. I have an active directory domain to which users log on. What I am trying to do is give users standard "domain user" rights on the AD domain, but allow these users "Administrator" rights on their respective workstations. I'm sure there are a few ways to do this, but I'm haveing trouble figuring out exactly how to do it. My preferred method would be to create an AD group policy that allows administrative rights on the local workstation, but standard "domain user" rights on everything else. I would appreciate any help you can offer.
Thanks

8 replies

by kennethaj

I have 50 workstations, but only one user would use a particular system. Also, I don't have any roaming profiles. I hope this helps.

by timwalsh

There is not a way to do this from within Group Policy.

The only way I have found to do this is to add the user's domain account to the Administrators group on the local computer. This will allow the user to be an administrator over his own computer, but only have the user rights assigned at the domain level when accessing domain resources or other computers.

by info-man-

I agree with tim.walsh@cos.sparta.com. You can not do this with Group Policy. In AD, you make the user a domain user. On the local machine, you make that same domain user an administrator on that particular machine. I would be a happy guy if it was possible to do what you are asking.

This discussion is closed to new replies.