Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How do I define the built-in administrators group in a group policy? For example

Computer Configuration => Policies => Windows Settings => Security Options => Local Policies => User Rights Assignment => Adjust memory quotas for a process

Do I need to set the string "BUILTIN\Administrators" or just "Administrators"?

What about "LOCAL SERVICE" and "NETWORK SERVICE"?

Do I need to set "NT AUTHORITY\LOCAL SERVICE" or just "LOCAL SERVICE"?

Microsoft documentation is very misleading and incomplete in that respect. Thanks in advance!

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Do I need to set the string "BUILTIN\Administrators" or just "Administrators"?

What about "LOCAL SERVICE" and "NETWORK SERVICE"?

Do I need to set "NT AUTHORITY\LOCAL SERVICE" or just "LOCAL SERVICE"?

You don't need the explicit BUILTIN or NT AUTHORITY at the beginning, as your domain should successfully infer it - there's only one group named Administrators, only one account named LOCAL SERVICE and only one account named NETWORK SERVICE.

For future reference, when in doubt, keep two things in mind:

  1. You can use the Browse -> Check Names GUI options to have the proper object filled in for you.

    • If you're building a script based on this, you can then look up the properties, including the SID, of the object that's been filled in.

  2. As with anything else, when in doubt, specify explicitly or prefer a more qualified/distinguished named over a less qualified/distinguished one.
share|improve this answer
    
Thanks for answering. Some background: I am currently building GPOs based on the CIS security benchmarks. A lot of this checks are failing as the regular expressions are expecting "BUILTIN\Administrators" and "NT AUTHORITY\LOCAL SERVICE" –  Matze Jul 30 '14 at 7:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.