Aron Smetana: Manage Workstations Without Domain Admin Rights

Tuesday, July 9, 2013

Manage Workstations Without Domain Admin Rights

Petri IT Knowledgebase Manage Workstations Without Domain Admin Rights

How can I manage workstations if I don't have domain administrator rights?

It's common that IT staff are given domain administrator rights for a number of reasons, one being that it's a convenient way to log on to workstations with local administrator privileges. But from a security standpoint, giving high-level access to Active Directory (AD) for the sake of an easy life, puts your IT infrastructure at risk.

How-To: Monitor Exchange Server Health & Performance

Read this How To from SolarWinds and learn the best practices for monitoring the health & performance of your Microsoft Exchange Servers.

Don't wait until it's too late!
Read How To>>

Create an AD group for workstation management

First we need to create a management group in Active Directory for users who will have rights to log on to workstations with administrative privileges.

Log on to Windows Server 2012 with a user account that has rights to create AD users and groups, and create Group Policy Objects (GPO).
Open Server Manager from the icon on the desktop Taskbar or from the Start screen.
Select Active Directory Users and Computers from the Tools menu.
In the Active Directory Users and Computers MMC, right-click the Users container in the left pane, and select New > Group from the menu.
In the New Object dialog box, name the group "Workstation Administrators" and click OK.
Make sure the Users container is selected in the left pane of the AD Users and Computers MMC and double-click the new group in the right pane. Switch to the Members tab in the properties dialog box and click Add.
In the selection dialog box, add any user accounts that you want to give administrative access to workstations and click OK.
Click OK in the properties dialog box.

$49 Per Month - Unlimited IT Training Including Practice Exams!

Add the new AD group to the local Administrators group

Now I'm going to create a GPO to add the new AD group to the local Administrators group on all my workstations. I recommend that you create a separate Organizational Unit (OU) for your workstation computer accounts. While it's possible to apply Group Policy to computer objects in the default Computers container, it would mean linking the GPO to the domain and filtering out domain controllers and member servers.

Open Group Policy Management (GPMC) from the Tools menu in Server Manager.
In the left pane of GPMC, expand your domain, right-click your workstations OU, and select Create a GPO in this domain, and Link it here from the menu.
Call the new GPO "Workstation Administrators" and click OK.
Expand your workstations OU, right-click the new Workstation Administrators GPO and select Edit from the menu.
In the Group Policy Management Editor window, expand Computer Configuration and Preferences.
Under Control Panel Settings, right-click Local Users and Groups, and select New > Local Group from the menu.
In the New Local Group Properties window, click the arrow to the left of Group name: and select Administrators (built-in) from the menu. Click Add.

In the Local Group Member dialog, click the box to the right of Name:.
Type Workstation Administrators in the selection box and click OK.
Click OK in the Local Member Group dialog and again in the properties dialog.
Close the Group Policy Management Editor window.

The next time Group Policy applies to computers in the workstations OU, the AD\Workstation Administrators group will be added to the local Administrators group, enabling IT administrators to manage workstations without domain admin privileges.