Assign User Rights to a Group in AD DS

Membership in Account Operators, Domain Admins, or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To assign user rights to a group in Active Directory Domain Services

To open Group Policy Management, click Start, click Run, type gpmc.msc, and then click OK.
In the console tree, right-click Default Domain Controllers Policy, and then click Edit.

Where?
- Domains\Current Domain Name\Group Policy objects\Default Domain Controllers Policy
In the console tree, click User Rights Assignment.

Where?
- Windows Settings\Security Settings\Local Policies\User Rights Assignment
In the details pane, double-click the user right that you want to assign.
Click Add User or Group.

If the button appears dimmed, select the Define these policy settings check box.
Type the name of the group to which you want to assign this right.

Additional considerations

To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or the Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.
To perform this procedure, you must first install Group Policy Management as a feature in Server Manager.
You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Assign User Rights to a Group in AD DS (http://go.microsoft.com/fwlink/?LinkId=138383). For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

Managing Groups