question

LULU-6701 avatar image
0 Votes"
LULU-6701 asked Thameur-BOURBITA edited

Create a active directory group and add it to local administrators group for each server

Hi

We would like to a create a active directory group for each server , and avoid local administrators to add users (local or from active directory) to be member of local administrator group.
We would like control the list of the member of local administrators in each windows server.

Any idea please ?

windows-serverwindows-active-directorywindows-server-2019windows-server-2016
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

Thameur-BOURBITA avatar image
0 Votes"
Thameur-BOURBITA answered Thameur-BOURBITA edited

Hi,

You can create a group for each server using the following command:

 Get-ADComputer -Server contoso.com -Filter {(Enabled -eq $true) -and (OperatingSystem -like '*Server*')} | Foreach{ New-ADGroup -Name "$($_.Name)_Administrators" -SamAccountName "$($_.Name)_Administrators" -Description "Administrator Access for $($_.Name)" -Path "OU=Groups -SVRAccess,OU=Role Based Access,OU=Groups,DC=contoso,DC=com" -GroupCategory Security -GroupScope DomainLocal }

You can create a schedule task if you want create this group automatically for new joined server.

Then you can use group policy preference to add this group on each server:

182545-image.png


On the setting above , you can also delete all users and groups and let only allowed groups.

To get more details you can refer to the following link :

Using Group Policy Preferences to Manage the Local Administrator Group




Please don't forget to mark helpful reply as answer


image.png (330.7 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.