Assign User Rights to a Group in AD DS
Applies To: Windows Server 2008
Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (https://go.microsoft.com/fwlink/?LinkId=83477).
To assign user rights to a group in Active Directory
To open Group Policy Management, click Start, click Run, type gpmc.msc, and then click OK.
In the console tree, right-click Default Domain Controllers Policy, and then click Edit.
Where?
- Domains/Current Domain Name/Group Policy objects/Default Domain Controllers Policy
In the console tree, click User Rights Assignment.
Where?
- Windows Settings/Security Settings/Local Policies/User Rights Assignment
In the details pane, double-click the user right that you want to assign.
Click Add User or Group.
If the button appears dimmed, select the Define these policy settings check box.
Type the name of the group to which you want to assign this right.
Additional considerations
To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or the Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.
To perform this procedure, you must first install Group Policy Management as a feature in Server Manager.