This document describes the important process of adding domain users and groups to the local groups on computers. By default, the group "Domain Users" is added to the local "Users" group and the group "Domain Admins" is added to the local "Administrators" group. These can be changed as described in the "Preventing non-department users from logging into department computers" document.

One of the first changes you may consider is the addition of your departmental OU administrators group to the local administrators group on department computers. If you perform this addition, you will not have to log into department computers as the local administrator to perform administrative tasks.

Another possible change is adding a department user or group to the local "Power Users" group. This will give the user increased privileges on the computer that may be required to properly run some programs.

This process will allow you to join domain users and groups to local groups (please note that these steps differ slightly depending on the username/password used in the first step):

1. Logon to the computer as a user with local administrator rights (at first this will probably be the local administrator account, but once a domain user/group is added to the local administrators group this may be a domain account).
2. Open the Computer Management console (Start menu - Program Files - Administrative Tools - Computer Management) and select the "Groups" section of the "Local Users and Groups" item as shown below:
   

   

3. Double-click on the group you wish to add domain users/groups to (you will see a window like the one below) and click the "Addá" button.
   

   

4. Select the pull-down menu at the top of the window and click on "ad.colorado.edu" as shown below:
   

   

5. If you have used a local account (eg. local administrator account) to logon, you will be prompted for a username and password to access a list of domain users as shown below. Enter the username and password of the administrative domain account you were given (not your IdentiKey username and password).
   

   

6. A list of users will begin to appear in the window and a warning message will follow shortly about there being too many objects to display. Click OK to this warning.
   

   

7. In the box below the list of users type in the name of the user or group you wish to add to the local group (if adding an individual user, enter that user's username) and press enter.
   

   

8. If there is only one match to your entry, it will be added to the group (skip to next step). If there are multiple possible matches, you will be shown a window like the one below and you can choose the correct user/group.
   

   

9. You should now see the domain user/group listed in the members of the local group as shown below. This procedure can be repeated until all local group configuration is complete.
   

   

Getting Help

help@colorado.edu