How to create local admin accounts

[Jobos]

What is the recommended way to create a new local admin user account on mass as I wish to disable the built-in Administrator account and create a new admin account but although I can use GP to disable the Administrator account I cannot see an easy way to make new accounts using GP.

 

Thanks in advance.

[Norphy]

My recommendation is "Don't" and "Use LAPS to manage the password for the existing account". Rename the existing Admin account with a GPO if you want to.

 

Failing that, create a new account using a GPP and, again, use LAPS to manage the password for that account.

[Jobos]

My recommendation is "Don't" and "Use LAPS to manage the password for the existing account". Rename the existing Admin account with a GPO if you want to.

 

Failing that, create a new account using a GPP and, again, use LAPS to manage the password for that account.

 

I'm using LAPS to change the password but I wanted to setup a new admin account so it has a different GUID.

[Rob_D]

We use the following command with MDT app deployment to create non admin local users:

Net user someaccount P4s5w0Rd! /Add /fullname:"someaccount" /passwordchg:no /active:yes

And then you could use net localgroup to add that account to the local administrator group.

 

Personally, I'd rather use LAPS to secure the local admin accounts than mess around trying to make new accounts (that invariably don't react quite like the built in admin)

[Norphy]

I'm not convinced, personally, that it's worth the effort but:

 

Create a GPO, or edit an existing one

Go to Computer Configuration --> Preferences --> Local Users and Groups

Right click, go to "New" and "Local User". Fill out the form, make sure the action is "Create"

To add the user to the local admin group, right click in the same place, go to "New" then "Local Group". Type "Administrators" in as the group name and make sure that "Action" is set to "Update". Press the Add button, then type in the name of your new account. That should work. You may need to prefix the name with .\

[thimon]

As others have said, don’t do it. LAPS is now built into Windows by default (or will be very soon), so all configurable via Group Policy.

[Jobos]

I'm not convinced, personally, that it's worth the effort but:

 

Create a GPO, or edit an existing one

Go to Computer Configuration --> Preferences --> Local Users and Groups

Right click, go to "New" and "Local User". Fill out the form, make sure the action is "Create"

To add the user to the local admin group, right click in the same place, go to "New" then "Local Group". Type "Administrators" in as the group name and make sure that "Action" is set to "Update". Press the Add button, then type in the name of your new account. That should work. You may need to prefix the name with .\

 

I'm going to leave the Administrator account enabled and keep managing the password with LAPS. Funny thing is when I tried to make a new user with GPP I couldn't as when I set the action to 'Create' the rest of the input fields are greyed out. I seem to recall a few years ago MS removed the ability to set passwords using GPP so that could be why I'm unable to create users too.