[mgriba]

Could somebody tell me why I lose the administrators group membership on a user account on a Win XP Pro box? I believe it is related to GPO, but cannot determine this to be the case and it would most likely have to be a local GPO - not domain GPO. Could anybody assist with informing me how I can create a Windows user account with Administrators group membership and retain that local user account with Administrator privileges? Thank you in advance.

[Curlyben]

OK from what you are saying this machine is on a domain.
Have you tried simply going into user accounts on the local machine and giving the selected user admin rights from there ?
( Control Panel > user accounts > ADD > enter user ID and Domain > Select OTHER option )
Works for me on the few people I allow local admin rights.

[mgriba]

It is on a domain, but it is a local user account that I am adding as a local admin. However, I have to continually add the local user account back to the Administrators group when I logoff/logon. I don't see (for some reason) why I lose this membership unless it is a local security policy or Group Policy that is doing it.

[Curlyben]

Have you tried adding a domain account as local admin.
Bear in mind that when the machine can't auth with the domain it uses stored credentials so will work as admin fine.

It this happening only on one machine or across the whole domain ?
WHat are you trying to achieve here ?

[mgriba]

Seems to be just this one computer. That is why I am ruling out GPO from the domain. I haven't added a domain account as a local admin. But, if that works, what prevents me from adding a "new" local user to the administrators group? Thanks for the quick replies. First time I have used this and I must say I am pleased.

[Curlyben]

If its only this one machine then I'd say the local GPO is messed up and stopping you adding local accounts.
I can't remember off hand which field you need, as all of my GPO is domain driven.
As best practice on domain machines all accounts should be domain controlled and the ONLY local account should be admin.
Makes for tighter security and better controlability.

[allendarrah]

Could somebody tell me why I lose the administrators group membership on a user account on a Win XP Pro box? I believe it is related to GPO, but cannot determine this to be the case and it would most likely have to be a local GPO - not domain GPO. Could anybody assist with informing me how I can create a Windows user account with Administrators group membership and retain that local user account with Administrator privileges? Thank you in advance.

Also running into this problem.

Workstation is Win XP SP3. We have a domain user account that is generic for our organization called PROC that is a domain user, not an admin, though. On some terminals we use a single program that requires administrative rights to the PC to run properly. On 4/5 of these terminals we add the user name PROC as a local admin so that program runs properly.

However, one 1/5 of these terminals that user account will "lose" its administrative rights anytime the PC is rebooted. This doesn't happen often, but once a week or so we have to manually go into the control panel user options and change it back from a "User" to an "Administrator". Any solution?