You can create GPO and link the GPO to domain or OU containing all the computers.
First you need to create a security group called Local Admin
- Log onto a Domain Controller, open Active Directory Users and Computers (dsa.msc)
- Create a security Group name it Local Admin. From Menu Select Action | New | Group
- Name the group as Local Admin.
- Add the Help Desk members to Local Admin group. I will add two users say Tom and Bob.
Next you need to create a group policy called “Local Admin GPO”
- Open Group Policy Management Console ( gpmc.msc )
- Right click on Group Policy Objects and select New.
- Type the name of the policy "Local Admin GPO"
Here you will add the group to the policy and put them in the groups you wish them to use.
- Right click “Local Admin GPO” Policy then select .
- Expand Computer configuration\Policies\Windows Settings\Security Settings\Restricted Groups
- In the Left pane on , Right Click and select ““
In the Add Group dialog box, select browse and type and then click“
- Click OK twice to close the dialog box.
- Click Add under “This group is a member of:”
- Add the “Administrators” Group.
- Add “Remote Desktop Users”
- Click OK twice
When adding groups, you can add whatever you want, the GPO will match the group on the system, if you type “Admins” it will match a local group called Admins if it exists and put “Local Admin” in that group.
- In Group policy management console, right click on the domain or the OU and select Link an Existing GPO
- Select the Local Admin GPO
Log on to a PC which is join to the domain and then runTom and Bob domain users can now access all PCs remotely as a local administrator. and check the local administrators group. You should see in that group now. Make sure all PCs you want to access should be move to an OU and properly link above GPO.