Add specific domain account to Local Administrators Group using GPO (SCCM 2012)

Before installing System Center 2012 Configuration Manager you need to create several domain accounts that will be used during installation and configuration of System Center 2012 Configuration Manager. The one of these is the Agent/ClientInstall installation account.
Agent/ClientInstall, a domain user account used when installing the Configuration Manager Client for client push. This user must be a local administrator on all domain computers you want to install the Configuration Manager Client.

For those who don’t know how to add domain account to Local Administrators Group using Group Policy this is a short guide.

Advice: Create a separate Security Group in Active Directory Users and Computers and add Agent/ClientInstall account as a member of that group.

On the domain controller open Group Policy Management console, add to Default Domain Policy, click on Edit.

When Group Policy Management Editor appears go to Computer Configuration –> Policies –> Windows Settings –> Security Settings –> Restricted Groups.On the Restricted Group right click and click on Add Group, browse to the your earlier created Security Group and add to the Restricted Group.

When you added group you have two different choices of what you want to do with the group you selected. Either you use “Members of this group” or “This group is a member of”. The differences of these two choices I’ll explain in two steps.

1. Step “Members of this group”

This is the choice you make when you want to add users to a group. What you select here is what you will see on your computers affected my this policy. If you want to add a user to the local administrators group on the computers then do not forget to add administrator also or the administrator account will be remove from the local administrators group on the domain computers.

2. Step “This group is a member of”

This options you can use if you want to add your selected group into another group. This is not something that will override any other configuration you have done. If you in first choice selected “G Ekobit SystemCenter agent” and with this option select that it will be added to the “Administrators” group any other user you might have added to the group won’t be overwritten by this choice.

After you are finished with your choice close GPO editor, open command prompt and type gpupdate /force on your domain controller and on the computers side.

Check you newly created settings on computers/servers side. Open Manage –> Local Users and Groups –> Groups –> Administrators.

Now we are ready to install Configuration Manager agent on our domain computers/servers. But… before that we need properly to install/configure System Center 2012 Configuration Manager . How to do this, I’ll explain in one of my next posts.

Until then, enjoy