Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The following scenario is weird. Please be advised.

I have created a GPO on an OU containing workstations like this:

enter image description here

This GPO purpose is to make the Backup Operators group a member of the local Administrators group on all the workstations inside the OU.

enter image description here

Here is the content of this GPO:

enter image description here

Then when I check if the GPO is applied using gpresult on a workstation inside the Organisational Unit (OU) on which the GPO is applied, I can see that it is correctly applied on that workstation:

enter image description here

But when I go check in the local group on the workstation, in the local Administrators group, I should see the Backup Operators group inside it, but no:

enter image description here

Even after a gpupdate /force followed by a reboot, I end up with the same result.

Have I done something wrong?

EDIT:

This is what I get in the Event Viewer after I do a gpudpate /force:

Security policies were propagated with warning. 0x4b8 : An extended 
error has occurred.

For best results in resolving this event, log on with a 
non-administrative account and search http://support.microsoft.com 
for "Troubleshooting Event 1202's".
share|improve this question
    
Have you checked the event viewer of the machine to check for errors? Secondly, try running the GUI Group Policy Results from the DC. –  Dan Dec 20 '11 at 14:17
    
I'v added a warning message I got in the Event Viewer. This warning message is not really helpful though. –  Jonathan Rioux Dec 20 '11 at 14:24

3 Answers 3

up vote 3 down vote accepted

Heh, you're going to slap yourself !

"Backup Operators" is a built-in Domain Local security group.

As per my aging MCSE, a domain local security group cannot be a member of another group.

It is a so-called "endpoint" group and can only apply to DACLs and the like.

share|improve this answer
    
If GPResult is showing the policy then surely it has met the security requirements? –  Dan Dec 20 '11 at 14:17
    
Thanks God! You've got it so much :) –  Jonathan Rioux Dec 20 '11 at 15:46
    
Now you also know where the error comes from: attempting to add a DL group to another group :) –  adaptr Dec 20 '11 at 16:09
    
I think it's useful to take a look at the clarification in the answer from @user95587. –  aculich Dec 20 '11 at 21:57

While I agree ultimately with @adaptr, this cannot be done, some clarification of terminology may be helpful.

You can create domain local security groups and nest them. It may depend on domain function level (ours is 2000, not very current) and it may depend on server version (we run 2003/2008R2) but it can be done.

However MS default builtin groups, both local and domain, have restricted nesting.

"You cannot add the default groups that are located in the Builtin container as members to other groups. However, you can add other groups as members to the default groups that are located in the Builtin container."

http://technet.microsoft.com/en-us/library/cc776499(WS.10).aspx

Both the Administrator and Backup Operators groups are in the domain Builtin OU, this would appear to apply to clients (local users and groups) as well.

share|improve this answer
    
I think you mean no nesting there. –  adaptr Dec 21 '11 at 8:51
    
@adaptr - For the default builtin groups, nesting is a one way "add". I view that as limited or restricted but not completely disallowed. –  user95587 Dec 22 '11 at 17:40

Seems backwards to me. I've always added the "Administrators" group to the restricted groups GPO and added the appropriate members. Keep in mind, this will overwrite what's there so make sure you add domain admins back in.

Actually, is there another GPO that's adding Domain admins to the Administrators group? That could be overwriting this GPO if applied after. For example, the default domain policy.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.