Hello Albertosd77,
Thank you for posting in Microsoft Community forum.
You can user GPO Preferences.
1.Create one GPO and link it to domain.
2.Create one domain group and put all the domain computers except Domain Controllers to this group (such as group1).
3.Click the new GPO you created just now and add group1 under "Security Filtering".
Make Authenticated users have "Read" permission.
Make computer group have "Read" and "Apply group policy" permissions.
4.Edit this GPO and go to the following GPO section: Computer Configuration –> Preferences –> Control Panel Settings –> Local Users and Groups;
5.Add a new rule ( New -> Local Group );
6.Select Update in the Action field (it is an important option!);
7.Select Administrators (Built-in) in the Group Name dropdown list.
8.Click Add button.
9.In Local Group Member windows:
Name: select the domain user you want.
Action: Add to this group
10.Run gpupdate /force or restart the domain computers and check if the domain user is in local Administrators.
I hope the information above is helpful.
If you have any question or concern, please feel free to let us know.
Best Regards,
Daisy Zhou