What is the difference between applying user rights through these two mechanisms:
- Policies -> Windows settings -> Security Settings -> Restricted Groups
- Preferences -> Control Panel -> Local Users and Groups
Local users and groups is a way to manage users and groups that are on the local PC that you are looking at. The local users can log on locally and access local resources. Local groups can be used to restrict and allow access to local resources.
Restricted groups allow you to modify, through Active Directory, the membership of groups that exist only on local Windows machines. So if you create a local group created through the "Local users and Groups" control panel and name it "Local Group 1", and then do the same thing on two other computers naming the groups "Local Group 2" and "Local Group 3" respectively, you can choose to "push" a domain user account into each of those three groups using group policy.
The benefit to this is that you can easily add a domain account to each of the local administrators groups on each PC in a domain without granting excessive domain rights.
The differences are subtle.
Policies -> Windows settings -> Security Settings -> Restricted Groups
enables you to modify (not add or delete) only groups (not users directly). You can modify either local or domain groups. The modifications you can do to a specified group are adding members and adding it as a member of another group. It is only available in a computer GPO.
Preferences -> Control Panel -> Local Users and Groups
enables you to create, replace, update and delete local users and local groups. It is available in a computer GPO or a user GPO.
So they can do similar tasks. It is often just a matter of preference.