What's the least privileges of NetLocalGroupAddMembers?

Question

Anyone who know "What's the least privileges of NetLocalGroupAddMembers?" Appreciate your helps.

Answer 1

MSDN says:

If you call this function on a domain controller that is running Active Directory, access is allowed or denied based on the access control list (ACL) for the securable object. The default ACL permits only Domain Admins and Account Operators to call this function. On a member server or workstation, only Administrators and Power Users can call this function.

This is confirmed by Requirements for Network Management Functions on Active Directory Domain Controllers:

For updates, the default ACL permits only Domain Administrators and Account Operators to write information. One exception is that users can change their own password and set the usri*_usr_comment field. Another exception is that Account Operators cannot modify administration accounts.

and Requirements for Network Management Functions on Servers and Workstations:

By default, only Administrators and Power Users can write information.