[Samba] remotely adding domain users to Administrators group on a domain machine

[Thomas Gutzler]

Hi,

I'm trying to add domain users to the Administrators group of a domain
machine using the net command. On Windows 2000 and XP that's not a
problem. Windows 7 Enterprise seems to be more difficult, though.
With the same commands I can list the members of the group:
net rpc group members Administrators -U "machine\admin" -S machine
This works fine and includes machine\admin
When I'm running
net rpc group addmem Administrators "domain\user" -U "machine\admin" -S machine
Windows 7 tells me: Could not add domain\user to Administrators:
NT_STATUS_ACCESS_DENIED
I've been looking around in the security policies but couldn't find
anything related.

Any ideas how to make this work?

Cheers,
  Tom