Re: How to configure local PC group membership via Group Policy?



See http://support.microsoft.com/?id=810076.

At the Add Group step, key (or Browse to) the name of the Domain group you
want to added to the local group.

Then use only the "This group is a member" of part, click Add and key the
name of the Local Group you want the Domain Group added to on the targetted
computers. You can not "Browse" to the local group, but you can key the
name.

Don't put anything in the "Members of this group" box. Use AD Users and
Computers to populate the Domain Group.

--
Bruce Sanderson MVP Printing
http://members.shaw.ca/bsanders

It is perfectly useless to know the right answer to the wrong question.



"Shane@smeIT" <shane@xxxxxxxxxxxxxxxxxxxx> wrote in message
news:OUlYLhLUFHA.228@xxxxxxxxxxxxxxxxxxxxxxx
> Hi Simon
>
> Thanks for your reply. I can't get my head around how this works (or get
> it to work for that matter :(
>
> The server is a W2003 Server, with WXP Clients.
> I create a new GPO and call it say RestrictedGroups.
> I Edit RestrictedGroups (Computer Configuration / Windows Settings /
> Security Settings / Restricted Groups)
> There are three configuration points here;
> First is Add Group (I'm assuming I need to create a security group
> for this purpose first and browse to it here)
> So let's just say I created a security group called TestRG, and
> have browsed to and selected it here
> Next is members of this group
> Again I can browse to a Domain based security group or user and add
> them in here
> Finally 'This group is a member of'
> I can only browse to Domain based groups here, not local groups?
>
> What I want to be able to do is make a Domain level Security Group a
> member of a Local Built In Windows XP Security Group on a selection of
> Windows XP computers (based on OU membership) from the server via Group
> Policy. From what I have read researching Restricted Groups this seems to
> be the way to do it but I seem to be missing something as it doesn't seem
> to be working. The members and the members of that I am configuring just
> aren't working?
>
> Help..!!
>
> Thanks Simon
>
> --
> Kind Regards
>
>
> Shane
> SME IT Solutions
> Email: mailto:shane@xxxxxxxxxxxx
>
> "Simon Geary" <simon_geary@xxxxxxxxxxx> wrote in message
> news:%23SEb3ZAUFHA.3056@xxxxxxxxxxxxxxxxxxxxxxx
>> You can use restricted groups to do this.
>> http://support.microsoft.com/?id=228496
>>
>> "Shane@smeIT" <shane@xxxxxxxxxxxxxxxxxxxx> wrote in message
>> news:OaY656%23TFHA.2872@xxxxxxxxxxxxxxxxxxxxxxx
>>> Does anyone know how to do this?
>>>
>>>
>>> Basically I want to be able to configure local security group membership
>>> on Windows XP PC's via Group Policy from a Windows 2003 Server.
>>>
>>> TIA
>>>
>>> --
>>> Kind Regards
>>>
>>>
>>> Shane
>>> SME IT Solutions
>>> Email: mailto:shane@xxxxxxxxxxxx
>>>
>>>
>>
>>
>
>


.



Relevant Pages

  • fine tuning script
    ... know the domain group name, just the members. ... ' Subroutine to enumerate members of local group. ... For Each objMember In objGroup.Members ...
    (microsoft.public.windows.server.scripting)
  • Difference between a domain group and a local group
    ... Richard Mueller made this comment about his AddToGroup.vbs script: ... you could create a domain group. ... Make the users members of ... the local group on each computer. ...
    (microsoft.public.scripting.vbscript)
  • EnumLocalGroup - fails when "NT AUTORITY/SYSTEM" is member of group
    ... On Error GoTo 0 ... Enumerate members of the local group. ...
    (microsoft.public.windows.server.scripting)
  • Re: Group Policy questions
    ... supresses errors. ... > will not work as a logon script as when run twice, ... >> Purpose = add ITTechnicians Domain Group to Administrators Local Group ... >> 'Get domain group and assigned to ITTechs Variable ...
    (microsoft.public.windows.group_policy)
  • Re: Group Policy questions
    ... will not work as a logon script as when run twice, ... > Purpose = add ITTechnicians Domain Group to Administrators Local Group ... > 'Get domain group and assigned to ITTechs Variable ...
    (microsoft.public.windows.group_policy)