samba - Mar 2013 - Making users local administrators

I have Samba 4 (lastest version, I think) set up for Active Driectory. 
Everything is working just, using Microsoft's Group Policy Editor to manage 
stuff. Except one thing:

For reasons you don't want to get me started on, I need all users to have 
local administrative priviliges on any computer on the domain. This is 
supposed to be a simple, straightforward thing. Google has led me to half a 
dozen different ways to do this through group policies. And none of them 
work. I can set any other kind of group policy I want, power saving 
settings, screen saver settings, various security settings in IE, and the 
new settings show up with a gpupdate /force, but I cannot figure out how to 
add someone to the local administrators group. Can somebody point me to a 
really remedial howto? Something like "group policies for complete
idiots"
maybe.

An easy way is:

For the Administrator group on the local machine, add "domain users"
to that *local* group.

[This means that any domain authenticated user will have local admin
privs.]

---
While I've not done this via GPO - this looks like a reasonable way of
doing so.

http://www.expta.com/2011/02/adding-users-to-local-security-groups.html

HTH

-Greg

TA> I have Samba 4 (lastest version, I think) set up for Active Driectory.
TA> Everything is working just, using Microsoft's Group Policy Editor to
manage
TA> stuff. Except one thing:

TA> For reasons you don't want to get me started on, I need all users to
have
TA> local administrative priviliges on any computer on the domain. This is
TA> supposed to be a simple, straightforward thing. Google has led me to half
a
TA> dozen different ways to do this through group policies. And none of them
TA> work. I can set any other kind of group policy I want, power saving 
TA> settings, screen saver settings, various security settings in IE, and the
TA> new settings show up with a gpupdate /force, but I cannot figure out how
to
TA> add someone to the local administrators group. Can somebody point me to a
TA> really remedial howto? Something like "group policies for complete
idiots"
TA> maybe.

-- 
Gregory Sloop, Principal: Sloop Network & Computer Consulting
Voice: 503.251.0452 x82
EMail: gregs at sloop.net
http://www.sloop.net
---