Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the difference between applying user rights through these two mechanisms:

  1. Policies -> Windows settings -> Security Settings -> Restricted Groups
  2. Preferences -> Control Panel -> Local Users and Groups
share|improve this question

Local users and groups is a way to manage users and groups that are on the local PC that you are looking at. The local users can log on locally and access local resources. Local groups can be used to restrict and allow access to local resources.

Restricted groups allow you to modify, through Active Directory, the membership of groups that exist only on local Windows machines. So if you create a local group created through the "Local users and Groups" control panel and name it "Local Group 1", and then do the same thing on two other computers naming the groups "Local Group 2" and "Local Group 3" respectively, you can choose to "push" a domain user account into each of those three groups using group policy.

The benefit to this is that you can easily add a domain account to each of the local administrators groups on each PC in a domain without granting excessive domain rights.

share|improve this answer

The differences are subtle.

This one:

Policies -> Windows settings -> Security Settings -> Restricted Groups

enables you to modify (not add or delete) only groups (not users directly). You can modify either local or domain groups. The modifications you can do to a specified group are adding members and adding it as a member of another group. It is only available in a computer GPO.

This one:

Preferences -> Control Panel -> Local Users and Groups

enables you to create, replace, update and delete local users and local groups. It is available in a computer GPO or a user GPO.

So they can do similar tasks. It is often just a matter of preference.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.