By default the local Administrators group members have SYSADM authority over all DB2 instances. Provided that the Windows extended security is enabled (which it is by default), you will need to specify a particular group in the DB2 instance configuration parameter SYSADM_GROUP, e.g. "db2 update dbm cfg using SYSADM_GROUP DB2ADMNS". Make sure that the users that do need SYSADM access are in that group though.