Windows 7 SYSTEM cmd possibility?

Question

I have an access to system cmd (the one before you login to domain) and a non admin user located on domain. Since SYSTEM user is considered a higher privilege than admin in windows 7, how do I move one of my domain users to admin privilege on the same domain. I know that using: net localgroup administrators username /add will make this account an admin only locally on computer, usually even without connecting it to the network, which is completely useless help me with syntax or give an example of how to promote an already existing domain user to domain admin while having SYSTEM cmd available

Answer 1

You managed to be a local administrator on that machine, which means you can only manage that particular machine. In order to make changes to the domain, you actually need to manage the domain.

Such is being done through Active Directory Users and Computers. Using this either on the domain controller, or from your own computer and then connecting to the domain controller, can only be done using a user that has enough privileges to do this, such as a membership of Network Administrator or Administrators group.

The only thing you can do with this, is grant a non-admin user local admin to this computer, or perform any other admin tasks on this computer.

Answer 2

How do I add user to a domain using local admin cmd

You cannot. Only Domain accounts can add accounts to the domain.

Answer 3

You will need to add an account to the Domain Controller with administrative rights (or use the built in Administrator account on your Windows Server, not recommended though).

To create a new account in AD that you can use to add computers to the domain, do the following:

1. Log on as a member of the Domain Admins group, and then open Active Directory Users and Computers.
2. Right-click the Users container, click New, and then click User. Active Directory Users and Computers

3. Type the First name, Last name, and User logon name, and then click Next.

4. Type and confirm the user password, clear the User must change password at next logon check box, and then click Next.

5. Review the account information and then click Finish.

6. With the Users container selected, in the details pane (right pane), double-click the Domain Admins group.

7. Click the Members tab.

8. Click Add and then, in the Select Users, Contacts, or Computers dialog box, type the user logon name of the administrative account you just created, and then click OK.

9. Verify that your new account appears as a member of the Domain Admins group.

Further info is available at

https://technet.microsoft.com/en-us/library/cc700835.aspx