Add the Administrators security group to roaming user profiles

ComputerNeeds changes for IntuneAddAdminGroupToRUP

Supported on At least Windows Server 2003 operating systems or Windows XP Professional

23H2 · 1.0

What it does

This policy setting adds the Administrator security group to the roaming user profile share. Once an administrator has configured a user's roaming profile, the profile will be created at the user's next login. The profile is created at the location that is specified by the administrator. For the Windows XP Professional and Windows 2000 Professional operating systems, the default file permissions for the newly generated profile are full control, or read and write access for the user, and no file access for the administrators group. By configuring this policy setting, you can alter this behavior. If you enable this policy setting, the administrator group is also given full control to the user's profile folder. If you disable or do not configure this policy setting, only the user is given full control of their user profile, and the administrators group has no file system access to this folder. Note: If the policy setting is enabled after the profile is created, the policy setting has no effect. Note: The policy setting must be configured on the client computer, not the server, for it to have any effect, because the client computer sets the file share permissions for the roaming profile at creation time. Note: In the default case, administrators have no file access to the user's profile, but they may still take ownership of this folder to grant themselves file permissions. Note: The behavior when this policy setting is enabled is exactly the same behavior as in Windows NT 4.0.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: Software\Policies\Microsoft\Windows\System
Value name: AddAdminGroupToRUP
When enabled: DWORD 1
When disabled: value removed

Why it needs changes for Intune

Policy references a Windows supportedOn definition.
ADMX-INTUNE-WINDOWS-SUPPORTEDON-REFERENCE

In Intune

No native CSP; import the ADMX (needs changes first).

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Configure and deploy

Choose a state; the output below is generated from the template for exactly that.

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System]
"AddAdminGroupToRUP"=dword:00000001

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Add the Administrators security group to roaming user profiles
# Name: AddAdminGroupToRUP
# Scope: Machine
# State: Enabled
# Source: UserProfiles.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System' -Name 'AddAdminGroupToRUP' -PropertyType 'DWord' -Value 1

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_UserProfiles/AddAdminGroupToRUP

ADMX SyncML candidate

<SyncML xmlns="SYNCML:SYNCML1.2">
  <SyncBody>
    <Replace>
      <CmdID>1</CmdID>
      <Item>
        <Meta>
          <Format>chr</Format>
          <Type>text/plain</Type>
        </Meta>
        <Target>
          <LocURI>./Device/Vendor/MSFT/Policy/Config/ADMX_UserProfiles/AddAdminGroupToRUP</LocURI>
        </Target>
        <Data>&lt;enabled/&gt;</Data>
      </Item>
    </Replace>
    <Final/>
  </SyncBody>
</SyncML>

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Add the Administrators security group to roaming user profiles
# Name: AddAdminGroupToRUP
# Scope: Machine
# State: Enabled
# Source: UserProfiles.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System' -Name 'AddAdminGroupToRUP' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\AddAdminGroupToRUP') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Add the Administrators security group to roaming user profiles
# Name: AddAdminGroupToRUP
# Scope: Machine
# State: Enabled
# Source: UserProfiles.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System' -Name 'AddAdminGroupToRUP' -PropertyType 'DWord' -Value 1

History 3 retained releases

22H2 · 1.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

2 later releases left it unchanged.

Template

Internal name: AddAdminGroupToRUP
Namespace: Microsoft.Policies.UserProfiles
Template file: UserProfiles.admx
Release: Windows 11 23H2 · 1.0 · file set d784d0ea5f14a680…

Definition, editor controls and support

Definition

<policy class="Machine" displayName="$(string.AddAdminGroupToRUP)" explainText="$(string.AddAdminGroupToRUP_Help)" key="Software\Policies\Microsoft\Windows\System" name="AddAdminGroupToRUP" valueName="AddAdminGroupToRUP" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.UserProfiles:UserProfiles" />
      <supportedOn ref="Microsoft.Policies.Windows:SUPPORTED_WindowsXP" />
    </policy>

Editor controls

Supported platforms and category

Microsoft.Policies.Products:product:MicrosoftWindows
sha256:4b3cb6917b5e5b7cd142c0157f10882786b3e9ee67c29fd7b8f4c6cb2eec5fe7
Microsoft.Policies.UserProfiles:category:UserProfiles
<category displayName="$(string.UserProfiles)" name="UserProfiles" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:System" />
    </category>
Microsoft.Policies.Windows:category:System
<category displayName="$(string.System)" explainText="$(string.System_Help)" name="System" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Windows:definition:SUPPORTED_WindowsXP
<definition displayName="$(string.SUPPORTED_WindowsXP)" name="SUPPORTED_WindowsXP" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="2" ref="Microsoft.Policies.Products:MicrosoftWindows" />
        </or>
      </definition>
Microsoft.Policies.Products:product:MicrosoftWindows
<product displayName="$(string.MicrosoftWindows)" name="MicrosoftWindows" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <majorVersion displayName="$(string.MicrosoftWindows2000)" name="MicrosoftWindows2000" versionIndex="1">
          <minorVersion displayName="$(string.MicrosoftWindows2000_RTM)" name="MicrosoftWindows2000_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP1)" name="MicrosoftWindows2000_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP2)" name="MicrosoftWindows2000_SP2" versionIndex="2" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP3)" name="MicrosoftWindows2000_SP3" versionIndex="3" />
          <minorVersion displayName="$(string.MicrosoftWindows2000_SP4)" name="MicrosoftWindows2000_SP4" versionIndex="4" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsXP)" name="MicrosoftWindowsXP" versionIndex="2">
          <minorVersion displayName="$(string.MicrosoftWindowsXP_RTM)" name="MicrosoftWindowsXP_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsXP_SP1)" name="MicrosoftWindowsXP_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindowsXP_SP2)" name="MicrosoftWindowsXP_SP2" versionIndex="2" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer2003)" name="MicrosoftWindowsServer2003" versionIndex="3">
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_RTM)" name="MicrosoftWindowsServer2003_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_SP1)" name="MicrosoftWindowsServer2003_SP1" versionIndex="1" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_R2)" name="MicrosoftWindowsServer2003_R2" versionIndex="2" />
          <minorVersion displayName="$(string.MicrosoftWindowsServer2003_SP2)" name="MicrosoftWindowsServer2003_SP2" versionIndex="3" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsVista)" name="MicrosoftWindowsVista" versionIndex="4">
          <minorVersion displayName="$(string.MicrosoftWindowsVista_RTM)" name="MicrosoftWindowsVista_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.MicrosoftWindowsVista_SP1)" name="MicrosoftWindowsVista_SP1" versionIndex="1" />
        </majorVersion>
        <majorVersion displayName="$(string.WindowsServer2008)" name="WindowsServer2008" versionIndex="5">
          <minorVersion displayName="$(string.WindowsServer2008_RTM)" name="WindowsServer2008_RTM" versionIndex="0" />
          <minorVersion displayName="$(string.WindowsServer2008_R2)" name="WindowsServer2008_R2" versionIndex="1" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows7)" name="MicrosoftWindows7" versionIndex="6">
          <minorVersion displayName="$(string.MicrosoftWindows7_RTM)" name="MicrosoftWindows7_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer8)" name="MicrosoftWindowsServer8" versionIndex="7">
           <minorVersion displayName="$(string.MicrosoftWindowsServer8_RTM)" name="MicrosoftWindowsServer8_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows8)" name="MicrosoftWindows8" versionIndex="8">
          <minorVersion displayName="$(string.MicrosoftWindows8_RTM)" name="MicrosoftWindows8_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_RT)" name="MicrosoftWindows_RT" versionIndex="9">
          <minorVersion displayName="$(string.MicrosoftWindows_RT_RTM)" name="MicrosoftWindows_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer_6_3)" name="MicrosoftWindowsServer_6_3" versionIndex="10">
           <minorVersion displayName="$(string.MicrosoftWindowsServer_6_3_RTM)" name="MicrosoftWindowsServer_6_3_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_6_3)" name="MicrosoftWindows_6_3" versionIndex="11">
          <minorVersion displayName="$(string.MicrosoftWindows_6_3_RTM)" name="MicrosoftWindows_6_3_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_6_3_RT)" name="MicrosoftWindows_6_3_RT" versionIndex="12">
            <minorVersion displayName="$(string.MicrosoftWindows_6_3_RT_RTM)" name="MicrosoftWindows_6_3_RT_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindowsServer_10_0)" name="MicrosoftWindowsServer_10_0" versionIndex="13">
            <minorVersion displayName="$(string.MicrosoftWindowsServer_10_0_RTM)" name="MicrosoftWindowsServer_10_0_RTM" versionIndex="0" />
          </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_10_0)" name="MicrosoftWindows_10_0" versionIndex="14">
            <minorVersion displayName="$(string.MicrosoftWindows_10_0_RTM)" name="MicrosoftWindows_10_0_RTM" versionIndex="0" />
        </majorVersion>
        <majorVersion displayName="$(string.MicrosoftWindows_10_0_RT)" name="MicrosoftWindows_10_0_RT" versionIndex="15">
            <minorVersion displayName="$(string.MicrosoftWindows_10_0_RT_RTM)" name="MicrosoftWindows_10_0_RT_RTM" versionIndex="0" />
        </majorVersion>
      </product>
<strings><string id="Microsoft.Policies.Products:MicrosoftWindows">Windows operating system</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000">Windows 2000 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_RTM">Windows 2000</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP1">Windows 2000 Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP2">Windows 2000 Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP3">Windows 2000 Service Pack 3</string><string id="Microsoft.Policies.Products:MicrosoftWindows2000_SP4">Windows 2000 Service Pack 4</string><string id="Microsoft.Policies.Products:MicrosoftWindows7">Windows 7 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows7_RTM">Windows 7</string><string id="Microsoft.Policies.Products:MicrosoftWindows8">Windows 8 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows8_RTM">Windows 8</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003">Windows Server 2003 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_R2">Windows Server 2003 R2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_RTM">Windows Server 2003</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_SP1">Windows Server 2003 Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer2003_SP2">Windows Server 2003 Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer8">Windows Server 2012 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer8_RTM">Windows Server 2012</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_10_0">Windows Server 2016 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_10_0_RTM">Windows Server 2016</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_6_3">Windows Server 2012 R2 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsServer_6_3_RTM">Windows Server 2012 R2</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista">Windows Vista operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista_RTM">Windows Vista</string><string id="Microsoft.Policies.Products:MicrosoftWindowsVista_SP1">Windows Vista Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP">Windows XP operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_RTM">Windows XP</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_SP1">Windows XP Service Pack 1</string><string id="Microsoft.Policies.Products:MicrosoftWindowsXP_SP2">Windows XP Service Pack 2</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0">Windows 10 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RT">Windows 10 RT operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RTM">Windows 10</string><string id="Microsoft.Policies.Products:MicrosoftWindows_10_0_RT_RTM">Windows 10 RT</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3">Windows 8.1 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RT">Windows RT 8.1 operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RTM">Windows 8.1</string><string id="Microsoft.Policies.Products:MicrosoftWindows_6_3_RT_RTM">Windows RT 8.1</string><string id="Microsoft.Policies.Products:MicrosoftWindows_RT">Windows RT operating systems</string><string id="Microsoft.Policies.Products:MicrosoftWindows_RT_RTM">Windows RT</string><string id="Microsoft.Policies.Products:WindowsServer2008">Windows Server 2008 operating systems</string><string id="Microsoft.Policies.Products:WindowsServer2008_R2">Windows Server 2008 R2</string><string id="Microsoft.Policies.Products:WindowsServer2008_RTM">Windows Server 2008</string></strings>
Microsoft.Policies.UserProfiles:category:UserProfiles
<category displayName="$(string.UserProfiles)" name="UserProfiles" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:System" />
    </category>
<strings><string id="Microsoft.Policies.UserProfiles:UserProfiles">User Profiles</string></strings>
Microsoft.Policies.Windows:category:System
<category displayName="$(string.System)" explainText="$(string.System_Help)" name="System" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:System">System</string><string id="Microsoft.Policies.Windows:System_Help">Allows configuration of various system component settings.</string></strings>
Microsoft.Policies.Windows:definition:SUPPORTED_WindowsXP
<definition displayName="$(string.SUPPORTED_WindowsXP)" name="SUPPORTED_WindowsXP" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="2" ref="Microsoft.Policies.Products:MicrosoftWindows" />
        </or>
      </definition>
<strings><string id="Microsoft.Policies.Windows:SUPPORTED_WindowsXP">At least Windows Server 2003 operating systems or Windows XP Professional</string></strings>