1

I am trying to implement Restricted Group policy for my company's AD infrastructure, namely standardizing the local "Administrators" group. The documentation (and various webpages) said that the "Members of this group" policy will wipe out the "Administrators" group. However, an experiment made me confused:

I created 2 GPOs:

  • GPO-A replaces the Local Administrators with a list of domain users (e.g., "Alice" and "Bob")
  • GPO-B inserts a domain user (e.g., "Charlie" -- not part of GPO A) into the Local Administrators

Experiment 1: GPO-A gets applied first (link order 2)

Everything happens as expected: GPO-A cleans out Local Admins and add "Alice" & "Bob" gets added; GPO-B adds "Charlie".

Experiment 2: GPO-B is applied first

What happens:

  1. "Charlie" gets added to the Local Admins group (which also contains 2 local users)
  2. The local users on the PC gets deleted, and "Alice" and "Bob" gets added.
  3. Result: Local Admins contain "Alice", "Bob", and "Charlie"

My confusion: In Experiment 2, I thought GPO-A will totally erase the Local Admins group, including users added by GPO-B (since GPO-A gets applied after GPO-B). As it happens, it only erase local users from the Local Admins, but keeps the domain users.

So, is that the way it should be? Or am I doing something incorrectly?

5
  • How does GPO-B "insert" a user into the group administrators? Via preferences? Apr 4, 2012 at 9:01
  • @Helge Restricted Group, Member Of.
    – pepoluan
    Apr 4, 2012 at 9:06
  • So in both cases you use the same policy setting: Restricted Group, Member Of. I was confused because in one case you wrote "GPO-A replaces" and in the other "GPO-B inserts". Apr 4, 2012 at 9:08
  • What's not standardized about the Local Administrators group? It contains the local Administrator account and the Domain Admins group if the computer is joined to a domain. That's pretty standard.
    – joeqwerty
    Apr 4, 2012 at 10:46
  • @joeqwerty the 'standardized' Local Administrators group in my case would be populated with "Local Admins", "Domain Admins", and "HelpDesk". Plus, some systems would have an additional "<BusinessDomain> Admin" group according to which Business Domain uses those systems. IOW, it's 'standardized according to my company policy' instead of 'standard out-of-the-box Windows settings'.
    – pepoluan
    Apr 9, 2012 at 4:07

1 Answer 1

1

After both your experiments the local group Administrators contains the same members: Alice, Bob and Charlie. That is not the documented behavior and not what I have seen in my tests.

As KB279301 states,

any current member of a restricted group that is not on the Members list is removed with the exception of administrator in the Administrators group.

I can confirm from my own experience that if a group's members are set via multiple restricted group policies only those members remain that are configured in the GPO that is applied last.

To troubleshoot and find out why you are seeing a different behavior enable group policy logging to gpsvc.log as described here.

2
  • That is why I suspect something is wrong with my setup... what else should I check? Besides "enforced", what could possibly cause my results?
    – pepoluan
    Apr 4, 2012 at 10:17
  • Updated my answer with a link about gpsvc.log. Apr 4, 2012 at 10:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .