allow active directory user to login locally and make him local admin or regular user

I have an active directory all set up
and a joined computer to the domain

I want to allow a user to login to the local machine
also I want to make him admin on the local machine and I want to be able to make him regular user again
all from the domain controller

I tried the "allow login" from users right in the group policy but didn't work quite well

the work well be on zoom share screen with remote access

thanks