Set account permissions on Windows 10 devices

Supported editions for this characteristic: Frontline; Business organization Plus; Enterprise; Teaching Standard and Education Plus; Deject Identity Premium. Compare your edition

As an administrator, you can prepare the local administrative permissions level a user can accept on their Microsoft Windows 10 devices. For example, you lot can permit express control or total admission. This permission level is granted to the Windows account that'due south associated with a user'south Google Business relationship, non to a user's Google Account.

You can also provide administrative permissions to other existing Windows accounts. These accounts tin can be local to the device or Active Directory users and groups, even if they oasis't yet signed in to the device.

Requirements

  • To set administrative permissions for the user'south account, the device must have Google Credential Provider for Windows (GCPW) installed on it and be nether Windows device management.
  • To give administrative permissions to other existing Windows accounts, the device must be under Windows device management.

Fix authoritative permissions

  2. From the Admin console Home folio, go to Devices.

  3. On the left, click Mobile & endpoints and then Settings and then Windows settings.
  4. Click Account settings.
  5. To employ the setting to anybody, leave the top organizational unit selected. Otherwise, select a child organizational unit.
  6. Under Manage local administrative access to devices, select Enabled from the list of items.
  7. To set the user's account permissions (requires GCPW):
    • SelectStandard User to assign users standard accounts without administrative permissions. If y'all cull this pick, enter at least one account in theGive local administrative access field (described in the next step). Otherwise, no accounts will exist in the Local ambassador grouping.
    • SelectLocal Ambassador to assign users local administrative permissions.

      Windows limitations :

      • The user gets the Local Administrator permission level after they sign in to their device the 2d time subsequently yous assign the permission level.

      • Changing a user's permission level from Local Administrator to Standard User isn't supported on Windows 10, version 1803.

  8. Nether Give local authoritative admission, enter existing Agile Directory users, Agile Directory groups, or local Windows user accounts that as well get local authoritative privileges. Use the following formats:
    • Agile Directory users: YourDomain\user
    • Active Directory groups: YourDomain\grouping
    • Local users: username

    Dissever values with commas. For instance:YourDomain\Win10admins,YourDomain\jsmith, prayes, rnguyen

    Important:

    • If this field is blank, the existing Local Administrators grouping is cleared. If you set up the user account type every bitStandard user, then no accounts have administrative admission. If you ready the user business relationship type equallyLocal administrator, then only the user has administrative admission.
    • If yous enter an account that doesn't exist, a new account is not created on the device, no accounts are added to the Local Administrator grouping, and the existing Local Administrator group is cleared.
  9. Click Salvage. If you configured a child organizational unit, yous might be able to Inherit or Override a parent organizational unit's settings.


Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.

Was this helpful?

How tin can nosotros better it?