I work for a computer software company. We are running AD on Server 2003. We have over 100 employees that need to have local Admin access to their machines without setting them up as Domain Admins to install and test software. They do so on a daily basis. Is there any way to do this? Everything I am finding is telling me I have to do it locally on each machine, which, with 100 users and new users coming on all the time, would be impossible.

Are you sure they require Admin privileges? Why not try Power Users first? You could create a Policy that adds Domain Users to the Local Admin Group, but I stand firm that it's a bad idea. :) Life's more painless for the brainless.

First, put all of them into a domain group, or if they are already in a group use that one. Next, put all of the computers that are affected into an OU, or put all of the computers in a group too. Create a policy following these instructions http://technet2.microsoft.com/windo... Apply this policy to the OU containing the computers. Or, apply it to the domain, filtering it to only the group that the affected computers are members of.

The users are already in the "Domain Users" Group. :) Although I guess you could create another one if you wish to be redundant. :) Life's more painless for the brainless.