How to make an Admin only for local computers?

[jmair]

I'm in need of making an admin account that can make changes only to staff computers. Is there a way to do this?

[psydii]

If all the staff computers are in an OU that does not contain other types of computers:

Create a Universal Security group, and into that put the users you wish to be admin. (call it something like ladmin_staffcomputers)

Create a GPO (or use existing staff computers gpo if its scope is sufficiently narrow)

Use GPP within that GPO to add the ladmin_staffcomputers to the local administrators group.

 

It is a very similar process if there isn't an OU and all the computers are comingled.

In addition to the ladmin security group, you will need to create a security group for the computers e.g. "computers_StaffComputers" and add all the staff computer accounts to that.

Then you will need to create an empty GPO (as above) and filter it by security group (the security group being the "computers_StaffComputers" you just created.

Now make the GPP settings as above.

Edited December 10, 2024 by psydii

[jmair]

brilliant. worked like a charm, thank you!

[penfold]

In the past I've also used to the same process to remove local admin accounts that someone had added over time. Can't remember the exact setting, but something like remove all and then just add the specific accounts so the only admin accounts assigned are the ones you want. Removes the problem of rogue technicians adding local accounts or users to the admin group when they can't get something to work properly.

[Davit2005]

Handy to have local admin groups setup for one if you have a contractor in who needs to install software jus need to add them to the group. Plus if you have other software that needs admin rights you can isolate to specific areas.

[DavR]

This is really useful, ta. I've been meaning to create a local-PC only admin account for workstation maintenance, and couldn't quite get my head round the best way of doing it.

 

GPO to add the custom group to local Admins on PC, will give that a go in a bit.

[MYK-IT]

I'd personally use Microsoft LAPS which can store the unique (per computer) admin credentials within Active Directory or Azure AD.

 

https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-scenarios-windows-server-active-directory

 

Can then issue the computer's admin credentials to whoever needs to service it etc, and passwords can rotate after set time, or upon use.

[jmak]

We use the method described *and* LAPS.

 

I want our team to have accounts allowing them to login as local admin or elevate their account. That way we know who has --caused-- fixed the issue.

 

We use the LAPS account as a break-glass with a 50 random character password that updates at regular intervals. It has occurred to me that it could be used to allow one off access as mentioned above for either a contractor or even a user (and then reset afterwards).

[psydii]

We also have all the local admin accounts set flagged as Protected Users in AD, so their auth tokens expire quickly, hindering replay attacks and lateral movement paths even if the account is and admin on more than one computer.

 

The main administrator account on each machine is also protected by LAPS (classic for now), and as per jmak, and used only as a break-glass account.

[Hoyt]

Folks that is some very good info. I've made a few notes.

 

Hopefully I won't need them though. We don't give ANYONE admin rights on anything unless they work for the I.T. department. Might be overkill but it's worked well so far.

[migueltc_17]

Hello, in order to resolve your issue you need to follow the following steps:

 

In this case I leave you two options depending on your demand

1. Create the user in Active Directory

• Example:soporte.local

2. Add as local administrator only on certain PCs

-Manually when there are few computers

• On each PC:
  Administración de equipos > Usuarios y grupos locales > Grupos > Administradores
  → AddDOMINIO\soporte.local

-With GPO (many computers)

• Create a GPO that applies only to the staff computers you need

• Route:
  Configuración del equipo > Preferencias > Configuración de Windows > Grupos locales

• Action: Update

• Group: Administrators (integrated)

• Member:DOMINIO\soporte.local

This way you will have an administration dedicated only to the computers you want without having to change the other systems. 

All the best

 

Google Translation (Red + italic)

 

Hello, in order to resolve your issue you need to follow the following steps:

 

In this case I leave you two options depending on your demand

1. Create the user in Active Directory

• Example:soporte.local

2. Add as local administrator only on certain PCs

-Manually when there are few computers

• On each PC:
  Administración de equipos > Usuarios y grupos locales > Grupos > Administradores
  → AddDOMINIO\soporte.local

-With GPO (many computers)

• Create a GPO that applies only to the staff computers you need

• Route:
  Configuración del equipo > Preferencias > Configuración de Windows > Grupos locales

• Action: Update

• Group: Administrators (integrated)

• Member:DOMINIO\soporte.local

This way you will have an administration dedicated only to the computers you want without having to change the other systems. 

All the best

[k-strider]

we also do this use GPO to add a user to the local administrator group (we used ladmin too) this local admin we also add to the Protected users group... this stops its credentials being stored on the machine so for our techs they can log into a workstation as a local admin but we know the hashed credentials aren't on there and we have never ran into an issue doing this.... I would say though one thing to realize is because these creds aren't cached off line sign in wont work...

 

In fact other than the actual domain administrator account any one you give any sort of local/ domain admin privileges too you should put in the protected users group.... 

[KK20]

old post, but consider using gMSA instead of traditional scheduled task privileged users.  Takes the headache out of password rotation.