Re: Restricted Groups problem

By putting an entry in the "memberof" section, you're saying that it's going
to be made a member of the groups defined. The group defined is the
administrators group. It is kind of counterintuitive, but that's what
works.

Are you trying to add a global group to a global group? Or am I mis-reading
that?




"GeorgeMc" <GeorgeMc@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:D11F87A7-B228-467C-BEA5-C08A8E9A3AD7@xxxxxxxxxxxxxxxx
Yes, the group type is a global group from "domain". And, I'm not clear
how
"member of" works, coul you elaborate a little more? I would think member
of
means that the local machine administrators account would then be a member
of
anothey type of account?

Thanks,

George

"Al Mulnick" wrote:

Sounds like a group type issue. I haven't tried it quite that way, but
all
you're really interested in is adding the group to the local
administrators.
Membership is not really critical to this situation.

What is the group type? Are you saying it's a global group from domain ?

As for not changing the local administrators group, you'll want to use
the
memberof feature only. Do not populate anything for the group.

Al


"GeorgeMc" <GeorgeMc@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:73A58687-AD81-4BD5-8B8A-A7D3CB9268BA@xxxxxxxxxxxxxxxx
Hi!

I'm having a problem assigning the users/groups I want to the local
machine
administrators groups through the Restricted Groups policy. Here's my
scenario:

- "domain"
- "sub.domain"
- OU in sub.domain called web servers

I have a Global Security group in "domain" called WebServerAdmins with
users
from "domain".

On member servers in the web servers OU of sub.domain, I can manually
add
domain\webserveradmins to the local administrators group.

I add "Administrators" to the Restricted Groups of sub.domain.
However,
when I try to add members to this group, domain\webserveradmins is not
available from the "domain" location. The individual members of
domain\webserveradmins are available however.

I also created a sub.domain\test local domain group and added the
global
domain\webserveradmins to it. However, in Restricted Groups, the only
sub.domain groups available to choose are sub.domain global groups such
as
sub.domain\Domain Admins.

The bottom line is that I want, via group policy, to add
domain\webserveradmins to the local machine administrators group of all
memberr servers of sub.domain.

In addition, I don't want to change the existing local member server
Administrators group, just add to what's existing.

Thanks,

George





.

Relevant Pages

  • Re: Power user group
    ... I think the answer is in the article 'How to configure a global group to be ... a member of the administrators group on all workstations. ... > torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway ...
    (microsoft.public.windowsxp.security_admin)
  • Re: List users in local administrators group on remote machine
    ... list all users in local administrators group on ... remove user from local administrators group on remote computer ... ' Check first if they are already a direct member. ...
    (microsoft.public.windows.server.scripting)
  • Re: How to make a AD group member of the local administrators grou
    ... Can I use your script and replace the user ingo with the group info or do I ... Clemens de Brouwer ... that group to the local Administrators group. ... ' Check if user already a member. ...
    (microsoft.public.windows.server.scripting)
  • Re: Restricted Groups problem
    ... the group type is a global group from "domain". ... "member of" works, coul you elaborate a little more? ... As for not changing the local administrators group, ... On member servers in the web servers OU of sub.domain, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Restricted Groups problem
    ... member servers in "sub.domain" via group policy. ... administrators group. ... Are you trying to add a global group to a global group? ... On member servers in the web servers OU of sub.domain, ...
    (microsoft.public.windows.server.active_directory)