I've been trying to find out if it's possible to grant a domain user administrator rights on a workstation without going to the workstation and adding the user to the local Administrators group manually. Is there a way to do this in Group Policy?
Group Policy does have the Restricted Groups folder under Computer Configuration\Windows Settings\Security Settings. Restricted Groups lets you control the membership of local groups on your workstations and member servers. However, a limitation in Restricted Groups might be a problem in your situation. I assume that you have many workstations for which you want to grant the user administrator authority. Restricted Groups requires you to create a Group Policy Object (GPO) for each workstation with the appropriate user configured as an authorized member of Administrators. And don't forget, you'll need to create a new GPO each time you roll out a new computer. Not a good solution.
Time to get imaginative. Create a GPO and link it to an appropriate organizational unit (OU) that will ensure that the GPO is applied to the computers you want to control. In the GPO, create a Restricted Groups policy that makes Domain Admins and INTERACTIVE authorized members of Administrators. (INTERACTIVE is a special security principal that dynamically translates to whomever is currently logged on at the local console of the computer.)
We've now opened these workstations up, granting anyone with the Logon locally right local Administrators membership; by default, workstations give Everyone the Logon locally right, so we need to tighten that down. Create a group called Workstation Users and populate it with the accounts of all the users to whom you want to give administrator control.
We've tightened things a little, but now all members of Workstation Users are effectively administrators of all workstations because they have the right to log on locally/interactively. We need to associate each user with his or her workstation. Open each user's account properties in the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in. Select the Account tab and click Log On To. In the Logon Workstations dialog box, select The following computers (under This user can log on to:), then enter the user's workstation name in the Computer name field and click Add. Click OK twice.
Don't forget to repeat these steps for the rest of your user accounts. If you don't restrict members of the Workstation Users group to their assigned computer, they'll have administrator authority to all workstations that receive the GPO we created earlier.
