Managing workstations without domain administrator rights is not only possible but also enhances security by minimizing high-level access to Active Directory (AD). In this guide, we’ll walk through creating a dedicated AD group for workstation management and assigning it the necessary privileges using Group Policy. Please read Delete or Rename and Create a Protected Organisation Unit in AD, and Create and find Organisation Unit paths in AD.
Please see Change Active Directory Domain name from dot local to dot com, Batch rename multiple files on Windows, What are the effect of renaming an MBAM-Protected Computer, and Change the name of your macOS user account and home folder.
Step-by-Step Process: Creating an AD Group for Workstation Management
Let’s establish a management group in Active Directory for users who need administrative access to workstations.
Press the Windows key and search for Server manager to open the server management tool if not already launched.
In the Server Manager, select Active Directory Users and Computers from the Tools menu.
In the AD Users and Computers MMC, right-click the Users container. Choose New > Group from the menu.
Name the group “Workstation Administrators” and click OK.
In the Users container, double-click the newly created “Workstation Administrators” group, switch to the Members tab, and click Add.
Add the user accounts that need administrative access to workstations, and click OK to confirm.
Adding the New AD Group to Local Administrators Group
We will use Group Policy to add the “Workstation Administrators” group to the local Administrators group on all workstations.
Open Group Policy Management from the server manager Tools menu.
Expand your domain in Group Policy Management, and right-click your workstations Organizational Unit (OU).
Select Create a GPO in this domain, and Link it here.
Name the new GPO “Workstation Administrators” and click OK.
Expand your workstations OU, and right-click the new GPO and select Edit.
In the Group Policy Management Editor, navigate to Computer Configuration > Preferences > Control Panel Settings.
Right-click Local Users and Groups, and select New > Local Group.
In the New Local Group Properties window, select Administrators (built-in) from the Group name dropdown.
Click Add, then click the box next to Name.
Type “Workstation Administrators” and click OK.
Confirm by clicking OK again in the Local Member Group dialog.
Close the Group Policy Management Editor window.
The next time Group Policy is applied to the computers in the workstations OU, the AD\Workstation Administrators group will be added to the local Administrators group. This setup allows IT staff to manage workstations without needing domain admin privileges.
Conclusion
By creating a specific AD group for workstation management and linking it to the local Administrators group via Group Policy, you can grant necessary permissions without compromising your AD security.
This approach provides a more secure and controlled environment for managing workstations efficiently.
I hope you found this article useful on how to Grant Non-Domain Admin Privileges to Manage Workstation. Please feel free to leave a comment below.
