Currently on our domain, when a new user is created, they are automatically added to the Domain User group which is fine.

Also, when a new computer is added to the domain, the Domain Admin group is automatically added to the local Administrators group.

Where do I configure these settings? For example, when a new computer is added to the domain, I want to automatically add the Domain User group to the local computer's Network Configuration Operators group so that domain users can edit their IP address if they need to (when travelling on hotel networks).



You can use the Restricted Groups feature in a Group Policy to enforce membership of local groups on workstations/servers.



  • +1 - That's the best way to do it. – Evan Anderson Jul 27 '10 at 15:04
  • Thats sort of confusing, even though it says "Restricted Group" feature it still allows me to add domain groups to local groups? – ItsPronounced Jul 27 '10 at 16:00
  • @drpcken: Yes, the policy you create will restrict the members of the local group(s) to the collection(s) you specify. You can add domain groups (and/or local groups) to local groups on a workstation/server. This ensures the defined collections are members of specified local groups and will restrict the addition of unapproved members to these local groups. – jscott Jul 27 '10 at 16:15
  • Be careful to note that using Restricted Groups will REPLACE the members of the current groups with the groups you specify. It will not ADD the members to the group in ADDITION to the current members. – joeqwerty Jul 27 '10 at 21:05
  • @joeqwerty: Actually you can use Restricted Groups either in an append or overwrite manner. The "Members of this group" section will overwrite members, the "This group is a member of" section will append members. – jscott Jul 28 '10 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.