Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This may seem like an odd scenario, but for reasons that I have no control over I need to migrate a large list of user groups from an Active Directory server, to the local group policy of a server that is on the same domain that my AD manages. How can I do this?

I know that there is a MS Active Directory migration tool but I suspect it will not aid me in "downgrading" to a local group policy security policy.

Is there a way that I can re-create and migrate my groups,with their associated domain users, to my Windows Server?


Why am I doing this?

Because it's been asked, I guess I can answer this question. The simple reason is that I currently have rights to setup and modify groups within an Active Directory Server, however, the company that I work for is forcing me to surrender those rights in the near future. I still need to maintain user access to the various databases that I administer on the machine that hosts the databases so I've decided to recreate the active security policies from within the local group policy settings of the server.

share|improve this question
2  
To clarify, will the groups and the users need to be created locally? Or is it "ok" to have the local groups just contain the existing domain users as members? –  Shane Madden Jun 15 '11 at 18:12
    
The goal is to create local groups, and then add the domain users to those groups. In other words, I do not need to create new user accounts but, instead, add the existing domain users to the new local groups. –  RLH Jun 15 '11 at 18:15
    
Yuo haven't mentioned why you need to do this but just to clarify, you cannot "downgrade" to local policy. Group policy settings will always have precedence. –  Jim B Jun 15 '11 at 18:20
    
Well, that was just the word that I decided to use. The bottom line is that I need to move multiple groups from one security environment into another. Specifically, AD to the local security group pool on a Win @k3 Server. –  RLH Jun 15 '11 at 18:26
    
So to be clear yuo don't want the local policy to take effect you just want it also set locally? –  Jim B Jun 15 '11 at 18:34

1 Answer 1

up vote 3 down vote accepted

To answer the question I think you're asking: So long as your Database Server is a domain member, there is no reason why you can't add Domain User Accounts to a local server group to use for SQL Server authentication.

I'm not sure what you mean about recreating the security policies in the local server policy? Are you trying to recreate GPO settings on the local server? If so that won't work if your domain administrator sets a group policy.

share|improve this answer
    
+1 What he said. –  mfinni Jun 15 '11 at 19:16
    
All I want to do is create a series of security groups that are local to the Windows Server. The groups must mimic the groups in active directory by name, and the users that are within them. I'm not looking to migrate any form of application/file/db form of policy, I just want to copy-and-paste the groups names and their users. I apologize if my request isn't clear. I'm primarily a WinForms/SQL Server developer. I've had to work in AD, as directed by my managers, for security within my apps. I can manually implement what I am trying to do but that will be very time consuming. –  RLH Jun 15 '11 at 19:30
    
Then what you asked will work, just recreate the groups and add the users you need. –  ITHedgeHog Jun 15 '11 at 19:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.