Hi I have to add to every win7 client the owner of the notebook as a local administrator. Now I know it will not that easy. In the Active Directory there is a "Managed By" field on the computer object. My idea was that I can set there the domain user account of the notebook owner. Is there a way to add automatically the "Managed By" user as a local administrator of the win7 client? It would be the best when I can do this with GPO. I think it could be also a way that I will use a logon script.

Logon script is a way to realize it. However, if your domain users do not have a valid local computer administrator certificate, they do not have permissions to add their domain account into the local administrator group. Basically, we cannot change local user and group settings from a Domain Controller. This is for security reasons.Arthur Xie - MSFT