Re: Restricted groups

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance



Howdy!

Haim Beyhan schrieb:
Hi,

I want to implement restricted groups in our group policy.
We have Administrator, Domain\Domain Admins in local Administrators group of every machine and Domain\UserX on UserX machine.
How can I use group policy to keep the current local Administrators group members and add a new domain global group as a member in local Administrators group?

Right-click "Restricted Groups", choose "Add group" and select the group that you want to make local admins on the workstations. Click "OK". At the lower box where it says "This group is a member of" you go and add the local administrators group of a workstation.

If you had a workstation with adminpak.msi installed, you could also do it the other way round: Right-click "Restricted Groups", select the _local administrators_ group by focussing on the local machine, click "OK" and then select the group you want to put into the local administrators group at "Members of this group" by refocussing the domain with its users and groups.

Somewhat understandable? ;-)

cheers,

Florian
--
Nachwuschsadmin aus dem Süddeutschen/Germany.
eMail: Vorname [bei] frickelsoft [Punkt] net.
.



Relevant Pages

  • Re: Another Scripting Newbie - admin check
    ... the local Administrators group can be renamed. ... members, members due to group nesting of local groups, members of domain ... ' Enumerate members of this group. ... For Each objMember In objLocalGroup.Members ...
    (microsoft.public.windows.server.scripting)
  • Re: Another Scripting Newbie - admin check
    ... the local Administrators group can be renamed. ... members, members due to group nesting of local groups, members of domain ... ' Enumerate members of this group. ... For Each objMember In objLocalGroup.Members ...
    (microsoft.public.windows.server.scripting)
  • Re: remove local admin right in 200 client computer
    ... You could use Group Policy Restricted Groups using "members of this group" ... to enforce membership of the local administrators group. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Another Scripting Newbie - admin check
    ... members, members due to group nesting of local groups, members of domain ... Dim objRootDSE, strDNSDomain, adoConnection, adoCommand ... ' Bind to the local Administrators group on each computer ... For Each objMember In objLocalGroup.Members ...
    (microsoft.public.windows.server.scripting)
  • Re: delegation question....
    ... in WIN2000 you do the first part on the Domain Controller and the second ... will remove all current members of the local group on which you are focusing ... (the local Administrators group, in your case). ... > Admins" while creating a Restricted Group, ...
    (microsoft.public.win2000.active_directory)