Re: Administering OUs

From: Srinivas Acharya (anonymous_at_discussions.microsoft.com)
Date: 07/21/04 

Date: Wed, 21 Jul 2004 00:31:13 -0700

Hi,
"
IF You set this settings in
>GPO on the OU level and then define in this GPO that in
the builtin administrators group only UsersA,UserB and
DOmain Admins can be a member of local administrators group
this setting will be forced on all machines affected by
this GPO".

This is fine. But I don't how to configure this.Please help me.

Regards,
Srinivas Acharya
>-----Original Message-----
>Srinivas Acharya wrote:
>> Is it possible to do that. If possible, how?. Can you
>> eloborate please?. Some body told in my earlier related
>> query that it is possible by restricted groups?. They have
>> not eloborated? I don't know what are these restricted
>> groups? what is the purpose of them?..
>
>Yes, restricted groups are proper solution for this problem.
>Restricted groups are defined in the GPO (for example GPO
assigned on
>the OU level) to force content of specified security group
- for example
> local administrators on client machine. IF You set this
settings in
>GPO on the OU level and then define in this GPO that in
the builtin
>administrators group only UsersA,UserB and DOmain Admins
can be a member
>of local administrators group this setting will be forced
on all
>machines affected by this GPO.
>If somebody change this group membership on the next time
policy will
>applied the membership of local administrators group (for
example) will
>be set as defined in GPO.
>
>--
>Tomasz Onyszko [MVP]
>T.Onyszko@w2k.pl
>http://www.w2k.pl
>.
>

Relevant Pages

  • Re: Restricted group functionality
    ... Is it possible with that GPO? ... that the computer account objectin question are located in an OU ... as a member of the local Administrators group. ... making use of the Restricted Groups can be a bit more difficult ...
    (microsoft.public.windows.group_policy)
  • Re: Restricted group functionality
    ... That is part of the beauty of this GPO. ... It simply changes the default behavior of the Restricted Groups GPO from ... sure that the computer account objectin question are located in an OU ... as a member of the local Administrators group. ...
    (microsoft.public.windows.group_policy)
  • Re: Restricted group mistake - now BSOD for USERS groups
    ... Try adding domain users group for the domain and ... >> restricted groups. ... >> policy and stupidly did it on a live GPO instead of my test GPO. ... >> logon we will now see GPO security settings and personal settings be ...
    (microsoft.public.win2000.group_policy)
  • Re: Computer Management Security Problem
    ... you're using Restricted Groups in Group Policy to add the Domain ... Users group to the Administrators group? ... either using the Default Domain GPO or a GPO at the domain level to ... Users to the local Administrators group on your workstations, ...
    (microsoft.public.win2000.security)
  • Re: Administrators Group in Local Users and Groups
    ... Create the gpo in the ou where the Computers reside, ... > administrators group, but it won't let me browse outside the active ... >>> I am trying to find out how to add in the domain group Account ... >>> each workstations administrator group. ...
    (microsoft.public.windows.server.active_directory)
Quantcast