Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Applying Group Policy on 10 laptops in our organization, I accidentally deleted all the local groups and users from the laptops. Unfornately, even when logged in with Domain Admin, whenever I try to re-add the accounts, I recieve "Access is Denied." I know I made a newbie mistake when creating that first GPO, but is there anyway to put these Local Groups back?

share|improve this question
Did you actually delete the local groups, or just remove the domain groups/users from the local groups? – Zoredache Jan 25 '11 at 18:41

Some more information (like @Zoredache asks) about what you actually did is going to help us.

There isn't any built-in functionality to delete local groups and users from clients. If you are talking about deletion then you would've had to use a script to do it. If you did, and you really did delete entries from the local SAM on each PC, then they're gone.

I'm getting more of a feeling that you used "Restricted Groups" on, at least, your "Administrators" group, and have caused "DOMAIN\Domain Admins" to be removed from the local "Administrators" group on each of the clients. Fortunately for you, you can use Group Policy to "undo" this change, too. Locate the "Restricted Groups" policy that you damaged the local "Administrators" group with and add "DOMAIN\Domain Admins" back to the group. Reboot an affected client to force it to re-apply Group Policy (since you can't just run "gpupdate" remotely because you've "locked the keys in the car") and you'll see the change happen. Your other clients will pick up the change during periodic Group Policy refresh.

If you damaged memberships of local security groups with "Restricted Groups" policy there's not much I can tell you, other than "get to clicking". Removing the "Restricted Groups" policy won't cause the groups to return to their original contents. That's going to be a manual process. Hopefully you didn't damage many and, if you did, you might be able to script the re-population.

share|improve this answer

If you deleted the Administrators group I think you're screwed. You might be able to repopulate it from Safe Mode. Evan might know another trick too.

share|improve this answer
Thanks for the heads-up on this one, @Chris S. – Evan Anderson Jan 25 '11 at 20:33

You might need to reactive (if disabled) the local Administrator account on each machine and start over. Check out this question on how to get started with that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.