Goofoff

I know this is an old thread but have still seen people have issues with this. This exact part with domain admins is a quirk. Like many many people do, the first group you might try to add is Domain Admins, however if you add that group you will notice that users in this group will still be unable to open the console. This is due to the behavior of user context logged in. If UAC is enabled on the machine, you won’t have access to the SCCM you login to the machine with a domain admin account, unless you right click on the console and run it is Administrator. If you want this to work as intended, you will need to create a new security group in Active Directory, add Domain Admins to it, and then specify that group in SCCM.