[Samba] What is the recommend method to give users local admin access?

[Christian PERRIER]

Quoting Aniruddha (mailingdotlist at gmail.com):
> What is the recommend method with a samba pdc to give users local
> administrator access to their workstations? In Samba4 / Active Directory I

Give them a local account with admin access? But not give that to
their regular account?

Seriously, don't give people habits of working with admin access to
Windows machines. Really.

If you really want to do this...and reinstall Windows clients every 6
months, then create a domain group (something like "ShootSelfInFoot")
and put this global group in the "Administrators" local group on each
client.

Using "Domain Admins" is IMHO a wrong idea as this gives them more
power than just having admin access to the local machines.