Impostare le seguenti permission

Per domain users configurare le permission avanzate

https://technet.microsoft.com/en-us/library/jj649079(v=ws.11).aspx

Modificare la default domain policy come segue:
1.      Start Microsoft Management Console (MMC). On the Console menu, click Add/Remove Snap-in. 
2.      Add the Group Policy snap-in for the default domain policy. To do so, click Browse when you are prompted to select a Group Policy object (GPO). The default GPO is "Local Computer." Click Browse, and then click Default Domain Policy. You can also add GPOs for other domain partitions (specifically, organizational units). 
3.      Double-click the following items to open them: Computer Configuration, Administrative Templates, System, and Logon. 
4.      Click to select the Add the Administrators security group to roaming user profiles check box.  Click either Enable or Disable to enable or disable the new policy.