Re: Add additional domain group to local admins groups?
- From: "Roger Abell [MVP]" <mvpNoSpam@xxxxxxx>
- Date: Thu, 23 Mar 2006 01:11:05 -0700
If your machines are all at the current service pack level then a fix is
not needed. Reread the KB you referenced, as it does tell you how
to do what you are after. Just keep in mind that it is not saying directly
but assuming that you understand that to add a group to Administrators
on machines of an OU you are NOT defining Administrators as a
Restricted Group in an OU impacting that OU, but rather you ARE
defining the group to be added to the machine local Administrators
group as a Restricted Group and you are only using the Member Of
(as opposed to Members) settings in the Restricted Group definition.
Reread the KB, it does tell you how, although the language is a little
"strange" in places ("This group is linked to an OU-level GPO"), and
is also unclear in some statements ("If you create multiple Restricted
Groups policies for the same group in multiple GPOs, only one policy
will take effect." umm - actually depends on where linked) if you
compensate some and follow the examples you should be able to
figure it out.
"Valkan" <spam#npspam.com> wrote in message
news:FZadnZGBdeChrr_ZnZ2dnUVZ_tGdnZ2d@xxxxxxxxxxxxxx
Is using "restricted groups" the only way to automate adding additional
groups other than just "domain administrators" to the local administrators
on all domain workstation?
We would like to have a group with members that are local admins on all
workstations and also have the right to add and remove machines names to
the domain, but not be domain admins.
I have heard that there is some hotfix that was needed to prevent
restricted groups created from a GPO from flushing out the existing local
admins on the machines.
I was told this is that patch even though it doesn't actually say on the
page that's what it does.
http://support.microsoft.com/default.aspx?kbid=810076
We need to add new default local admins without removing the local admins
already on the machines (assigned users need to keep their admin rights in
order to run some apps on their PCs).
Would that hotfix have to be run on every machine on the domain or only on
the machine that was used to create the GPO?
.
- References:
- Add additional domain group to local admins groups?
- From: Valkan
- Add additional domain group to local admins groups?
- Prev by Date: Re: Add additional domain group to local admins groups?
- Next by Date: Re: Default Location for GPO's
- Previous by thread: Re: Add additional domain group to local admins groups?
- Index(es):
Relevant Pages
|
