Help with local adming rights on workstations

[TechMasters]

I am currently controlling admin privileages on local AD workstations
by using Restricted Groups, however I have a need in a particular area
to explicitly and individually add select users to the local machine
admin group, which prevents me from using RG (unless I create a ton of
GPOs)
I still would like to use RG to add my management groups consistently
to the local admin group on the machines, but using RG will erase any
manual additions to the local admin group. any ideas? I have too many
desktops to do this manually (over 4000)

 

[Denis Wong @ Hong Kong]

Hi,

Can you separate your computer objects in different OUs linking to different
GPO w/ RG?

br,
Denis

 

[Ken B]

There was a patch somewhere along the way that would make the RG policy
additive. I don't recall the number that fixes this, but I know one's out
there. Someone on here definitely has the number if you can't find it in
the MSKB.

Ken

 

[Bruce Sanderson]

See http://support.microsoft.com/?id=810076.

This KB article describes how to ADD domain groups or user accounts to local
groups as opposed to REPLACING them. This capability requires either XP
Service Pack 2 or a hotfix on SP1 and Windows 2000 computers.