Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to remove users from the Local Administrators group - it's built up a lot of them over time. So I have created a temporary Organizational Unity with a temporary GPO attached to it, and I've used Restricted Groups to populate the local admin group with the required groups.

When a PC is moved into the temporary OU, the GPO is applied and the local admin group is changed (users removed). When the PC is moved back to the original OU and the test policy is no longer applied, it reverts back to the original members of the local admin group.

How can I make the changes to the members of the Local Administrators group persist even when the GPO that caused those changes no longer applies? I want to be able to move the PC back to its original OU and have it keep the new, shorter list of Local Administrators.

For context, I'm using a temp OU to control/test the removal of local admin privileges on our applications.

share|improve this question

2 Answers 2

I was experimenting with Group Policy Preferences for a similar end.

You would definitely need to test this before use but I am fairly sure you can use a GPP managing the local Administrators group with a 'Replace' option set. Just be sure that you include all of the accounts you want to retain and you don't use the option to the remove the settings when system is out of scope.

share|improve this answer

What you describe is by design. Policies only take effect when the currently apply to an object. (There are exceptions, e.g. software deployment).

If you must use a restrictive groups policy to achieve this, then linking the policy to the original OU is your only option.

If you don't want the policy to target all computers in the original OU, you can place security filtering on the policy to only include specific computers.

share|improve this answer
    
WMI filtering can also be used to limit which machines within the original OU are affected. I've found WMI to be easier to deal with as it's more dynamic and machines that meet the filter's requirements are automatically included or excluded instead of having to manually control group membership. –  mrdenny Mar 18 '12 at 22:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.