Allow domain user full rights to local PC

Hi Univention supremos,

I have successfully joined a UCS Samba 4 domain, but now need to grant this user full access to the local PC (for printer driver installs etc). Normally, I would “manage” the Windows 7 computer and then add the domain user to the local PC administrators group. With UCS, it does not seem to find the user when I am trying to add them. I have typed the name in many formats without success. Does the user need to be a member of any special group in the directory to be allowed to be given local administrator access or perhaps it is just a case that Windows can not validate any usernames for some reason.

Can you point me in the right direction please

Many thanks indeed


I have checked a Windows 7 machine which is joined into a Samba 4 domain provided by UCS that it is possible to add users and groups from my AD-domain to local groups by using lusrmgr (local users and groups).
As far as I remember the “Domain Admins” group is added to the local admin group by default. You should be able to login with “Administrator” or any other user in this group and do the changes.

Best Regards,
Dirk Ahrnke

Maybe this is a little late, but this is how I do it.

Open a command prompt as admin and run this command to add ALL domain users as local admins:

net localgroup administrators “domain users” /add

Or just add the username of ‘john.smith’ as a local admin:

net localgroup administrators john.smith /add

Hope that helps.