Hi,

I want to make each domain account a member of the local admin group in their respective machines.

For example,

UserA ---- Local Admein on MachineA

UserB ----- Local Admin on MachineB

I've tried to accomplish this using restricted group but i need something like %DOMAIN ACCOUNT% so that each account is added to its own local group in its own machine.

%USERNAME% added the local user accounts but i want domain accounts.

Appreciate your valuable response.

> I've tried to accomplish this using restricted group but i need > something like %DOMAIN ACCOUNT% so that each account is added to its own > local group in its own machine.   You cannot with restricted groups. Use Group Policy Preferences "Local users and groups". For each computer, create a domain group %computername%_Admins, add appropriate users to that group and in GPP, add %computername%_Admins to builtin administrators.  

If you need a more detailed explanation of Martin's idea, I wrote a guide that you can follow. It is here:

http://deployhappiness.com/clever-way-manage-administrative-rights-regular-user

Thanks Martin.

Unfortunately, i don't have GPP because i am running server 2003 DC. GPP is available only in server 2008 and 2012.

Is there any other method i can use to do this ? (i.e VBScripting)