Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently on our domain, when a new user is created, they are automatically added to the Domain User group which is fine.

Also, when a new computer is added to the domain, the Domain Admin group is automatically added to the local Administrators group.

Where do I configure these settings? For example, when a new computer is added to the domain, I want to automatically add the Domain User group to the local computer's Network Configuration Operators group so that domain users can edit their IP address if they need to (when travelling on hotel networks).

Thanks

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

You can use the Restricted Groups feature in a Group Policy to enforce membership of local groups on workstations/servers.

http://support.microsoft.com/kb/279301

http://www.frickelsoft.net/blog/?p=13

share|improve this answer
    
+1 - That's the best way to do it. –  Evan Anderson Jul 27 '10 at 15:04
    
Thats sort of confusing, even though it says "Restricted Group" feature it still allows me to add domain groups to local groups? –  drpcken Jul 27 '10 at 16:00
    
@drpcken: Yes, the policy you create will restrict the members of the local group(s) to the collection(s) you specify. You can add domain groups (and/or local groups) to local groups on a workstation/server. This ensures the defined collections are members of specified local groups and will restrict the addition of unapproved members to these local groups. –  jscott Jul 27 '10 at 16:15
    
Be careful to note that using Restricted Groups will REPLACE the members of the current groups with the groups you specify. It will not ADD the members to the group in ADDITION to the current members. –  joeqwerty Jul 27 '10 at 21:05
    
@joeqwerty: Actually you can use Restricted Groups either in an append or overwrite manner. The "Members of this group" section will overwrite members, the "This group is a member of" section will append members. –  jscott Jul 28 '10 at 18:23
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.