Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to implement Restricted Group policy for my company's AD infrastructure, namely standardizing the local "Administrators" group. The documentation (and various webpages) said that the "Members of this group" policy will wipe out the "Administrators" group. However, an experiment made me confused:

I created 2 GPOs:

  • GPO-A replaces the Local Administrators with a list of domain users (e.g., "Alice" and "Bob")
  • GPO-B inserts a domain user (e.g., "Charlie" -- not part of GPO A) into the Local Administrators

Experiment 1: GPO-A gets applied first (link order 2)

Everything happens as expected: GPO-A cleans out Local Admins and add "Alice" & "Bob" gets added; GPO-B adds "Charlie".

Experiment 2: GPO-B is applied first

What happens:

  1. "Charlie" gets added to the Local Admins group (which also contains 2 local users)
  2. The local users on the PC gets deleted, and "Alice" and "Bob" gets added.
  3. Result: Local Admins contain "Alice", "Bob", and "Charlie"

My confusion: In Experiment 2, I thought GPO-A will totally erase the Local Admins group, including users added by GPO-B (since GPO-A gets applied after GPO-B). As it happens, it only erase local users from the Local Admins, but keeps the domain users.

So, is that the way it should be? Or am I doing something incorrectly?

share|improve this question
    
How does GPO-B "insert" a user into the group administrators? Via preferences? –  Helge Klein Apr 4 '12 at 9:01
    
@Helge Restricted Group, Member Of. –  pepoluan Apr 4 '12 at 9:06
    
So in both cases you use the same policy setting: Restricted Group, Member Of. I was confused because in one case you wrote "GPO-A replaces" and in the other "GPO-B inserts". –  Helge Klein Apr 4 '12 at 9:08
    
What's not standardized about the Local Administrators group? It contains the local Administrator account and the Domain Admins group if the computer is joined to a domain. That's pretty standard. –  joeqwerty Apr 4 '12 at 10:46
    
@joeqwerty the 'standardized' Local Administrators group in my case would be populated with "Local Admins", "Domain Admins", and "HelpDesk". Plus, some systems would have an additional "<BusinessDomain> Admin" group according to which Business Domain uses those systems. IOW, it's 'standardized according to my company policy' instead of 'standard out-of-the-box Windows settings'. –  pepoluan Apr 9 '12 at 4:07

1 Answer 1

After both your experiments the local group Administrators contains the same members: Alice, Bob and Charlie. That is not the documented behavior and not what I have seen in my tests.

As KB279301 states,

any current member of a restricted group that is not on the Members list is removed with the exception of administrator in the Administrators group.

I can confirm from my own experience that if a group's members are set via multiple restricted group policies only those members remain that are configured in the GPO that is applied last.

To troubleshoot and find out why you are seeing a different behavior enable group policy logging to gpsvc.log as described here.

share|improve this answer
    
That is why I suspect something is wrong with my setup... what else should I check? Besides "enforced", what could possibly cause my results? –  pepoluan Apr 4 '12 at 10:17
    
Updated my answer with a link about gpsvc.log. –  Helge Klein Apr 4 '12 at 10:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.