I'm configuring a GPO to add a local group to a user right policy, however, when configuring through GPO, all existing members of the right are removed on GPO application. You can obviously add all the users to the GPO to make sure these are retained but when the user is only local to the remote server e.g. NT SERVICE\SQLSERVERAGENT, this can't be added to the GPO from the DC which simply doesn't recognise it.

Am I right in assuming it's a case of using GPO when the user right should only contain domain accounts/groups, built-in users/groups but if additional user types need to be added then manual addition should be used instead?

Shame if it's the latter. Could do with being able to configure this via GPP like you can with local users/groups and having the option to retain the existing members which would address this initial observation

Cheers Jamie

1 Answer 1


In such specific case, please open the group policy's console from the SQL server itselft, you will need to install the RSAT tool. The options are different as it will detect your local user from it, and will allows you to select it when you edit the GPO.

Be adviced the GPO will not apply correctly on server where that local user don't exist.

  • I did wonder if this was the way to do it but didn't fancy installing RSAT tools on a server, especially in an environment that has a lot of security tools monitoring changes, just to be able to add the local users. This still doesn't address the unwanted removal of existing users/groups when applying the GPO but guess that's just the way user rights policy configuration works. Definitely something that could do with some improvement in my opinion.
    – jshizzle
    Commented Sep 14, 2021 at 16:39
  • 1
    @jshizzle I agree the unwanted removal is a headache, but from another perspective it do make sure that no one played with the local group, thus your GPO got the last word.
    – yagmoth555
    Commented Sep 14, 2021 at 17:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .