Q:

Best user group for developer domain users

What is the best user group for Visual Studio 2010 developers? Now we have added them as Member of Domain Users but under certain situations they need admin account.
We would like to give them more control on their machine but not on the domain network, of course.
Thanks.

A:

If they need admin access to their machines, but not the domain at large, you could:

individually give them admin access to the local machine (fine if a rare occurrence), or
Create a domain group, create an OU of machines these people would need admin rights on, assign the group admin rights to only that OU (reasonable, but a lot of work if this is a rare scenario), or
create a domain group, assign it custom permissions to administer all machines in the domain but not the domain itself (least preferable)

