Well, restricted groups policy can't just "add" someone to a group. Your local groups will mirror what is specified in the GPO. In some cases this is really handy because you may only want specific users/groups in there and Restricted Groups policy will remove any user/group that is not explicitly allowed. However, in your case, you only want to add someone, so you will probably need to make that change using a computer startup script. The following link has some VBScript samples that should give you a good start: http://www.activexperts.com/activmonitor/windowsmanagement/adminscripts/ usersgroups/localgroups/ Regards, //signed// Jamie R Nelson Systems Engineer Ingenium Corporation ________________________________ From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Johnson, Matthew Sent: Tuesday, June 12, 2007 9:04 AM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Add user to local administrators group Can I use a GPO to add a user to the local administrators group on all our pc's in our domain? I looked at the Restricted groups setting but I don't know if this will work. We have a windows 2000 domain. Thanks for any help, Matthew Johnson CONFIDENTIALITY STATEMENT: This electronic message contains information from Fisher-Titus Medical Center and may be protected health information or other confidential and privileged information under law. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this message is prohibited. If you have received this electronic message in error, please notify the sender immediately by reply e-mail or telephone at 419/668-8101.