When managing a Windows Small Business Server 2008 environment with mixed workstation types (particularly tablets with proprietary software like ThinkVantage), we often face this administrative dilemma: certain field staff need local admin rights on specific devices, while maintaining standard user permissions elsewhere. The manual approach of configuring local administrator groups on each tablet becomes unsustainable as the organization grows.

The most elegant solution involves leveraging Group Policy Preferences (GPP) with item-level targeting. Here's why this approach works best:

• Maintains centralized control through AD
• Applies permissions based on both user AND computer attributes
• Allows for dynamic adjustments as staff or devices change

First, ensure your AD structure reflects these groups:

// PowerShell: Create required AD groups
New-ADGroup -Name "TabletAdmins" -GroupScope Global
New-ADGroup -Name "FieldTablets" -GroupScope Global

Then create and link a GPO to your tablet OU:

# Group Policy Management Console commands
1. Right-click the tablet OU → "Create a GPO in this domain and Link it here"
2. Name: "Tablet Admin Rights Assignment"
3. Edit the GPO → Computer Configuration → Preferences → Control Panel → Local Users and Groups
4. Create new Local Group action

Configure the GPP with these critical settings:

Action: Update
Group name: Administrators (built-in)
Members: %DomainName%\TabletAdmins

Now set the targeting rules:

Item-level targeting → New Item → Security Group
Group: FieldTablets (computer group)

After gpupdate /force, verify with:

# On tablet:
net localgroup administrators
# Should show domain\TabletAdmins group

Common issues to check:

• Computer account in FieldTablets group?
• User account in TabletAdmins group?
• GPO applied to correct OU?
• Loopback processing enabled if needed?

For environments with frequent changes, consider these enhancements:

// PowerShell automated reporting
Get-ADGroupMember "TabletAdmins" | Export-CSV "C:\Reports\AdminUsers.csv"
Get-ADComputer -Filter {memberOf -eq "CN=FieldTablets,OU=..."} | Select Name

Remember that Windows SBS 2008 has some GPP limitations compared to newer versions. If upgrading becomes an option, consider migrating to a more recent Windows Server version for finer-grained control.

---

Managing local administrator rights in an Active Directory environment can be tricky when you need to grant elevated privileges to specific users only on certain machines. In our case, we have field technicians using tablet PCs that frequently require administrative access for troubleshooting ThinkVantage software issues, while regular office staff shouldn't have these privileges on any machines.

We'll use three key Active Directory features:

• Security Groups (for both users and computers)
• Group Policy Objects (GPOs)
• Group Policy Preferences (for modifying local groups)

Here's how to set this up properly:

# PowerShell: Create the necessary AD groups
New-ADGroup -Name "TabletAdmins" -GroupScope Global -Path "OU=Security Groups,DC=domain,DC=com"
New-ADGroup -Name "TabletComputers" -GroupScope Global -Path "OU=Security Groups,DC=domain,DC=com"

Create a new GPO and link it to the OU containing your tablet computers:

# PowerShell: Create and link the GPO
$gpo = New-GPO -Name "Tablet Local Admin Rights"
New-GPLink -Name "Tablet Local Admin Rights" -Target "OU=Tablet Computers,DC=domain,DC=com"

Configure the GPO to modify the local Administrators group:

1. Open the GPO in Group Policy Management Editor
2. Navigate to: Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups
3. Create a new action to update the "Administrators" group

The magic happens with item-level targeting to apply the change only when:

# Sample XML for Item-Level Targeting (simplified)
<ItemLevelTargeting>
  <Target>
    <Group name="TabletComputers" />
  </Target>
</ItemLevelTargeting>

After applying the GPO, verify the settings:

# PowerShell: Check local group membership
Get-LocalGroupMember -Name "Administrators" | Select-Object Name, PrincipalSource

Remember these important security aspects:

• Use separate groups for users and computers
• Document all changes in your change management system
• Consider implementing Just-In-Time administration for more sensitive environments

If the policy isn't applying:

# PowerShell: Check GPO application status
Get-GPOReport -Name "Tablet Local Admin Rights" -ReportType Html -Path "C:\temp\GPReport.html"
gpresult /h "C:\temp\GPResult.html"