1

This may seem like an odd scenario, but for reasons that I have no control over I need to migrate a large list of user groups from an Active Directory server, to the local group policy of a server that is on the same domain that my AD manages. How can I do this?

I know that there is a MS Active Directory migration tool but I suspect it will not aid me in "downgrading" to a local group policy security policy.

Is there a way that I can re-create and migrate my groups,with their associated domain users, to my Windows Server?

Why am I doing this?

Because it's been asked, I guess I can answer this question. The simple reason is that I currently have rights to setup and modify groups within an Active Directory Server, however, the company that I work for is forcing me to surrender those rights in the near future. I still need to maintain user access to the various databases that I administer on the machine that hosts the databases so I've decided to recreate the active security policies from within the local group policy settings of the server.

Improve this question
9
  • 2
    To clarify, will the groups and the users need to be created locally? Or is it "ok" to have the local groups just contain the existing domain users as members?
    – Shane Madden
    Jun 15, 2011 at 18:12
  • The goal is to create local groups, and then add the domain users to those groups. In other words, I do not need to create new user accounts but, instead, add the existing domain users to the new local groups.
    – RLH
    Jun 15, 2011 at 18:15
  • Yuo haven't mentioned why you need to do this but just to clarify, you cannot "downgrade" to local policy. Group policy settings will always have precedence.
    – Jim B
    Jun 15, 2011 at 18:20
  • Well, that was just the word that I decided to use. The bottom line is that I need to move multiple groups from one security environment into another. Specifically, AD to the local security group pool on a Win @k3 Server.
    – RLH
    Jun 15, 2011 at 18:26
  • So to be clear yuo don't want the local policy to take effect you just want it also set locally?
    – Jim B
    Jun 15, 2011 at 18:34

1 Answer 1

Reset to default
3

To answer the question I think you're asking: So long as your Database Server is a domain member, there is no reason why you can't add Domain User Accounts to a local server group to use for SQL Server authentication.

I'm not sure what you mean about recreating the security policies in the local server policy? Are you trying to recreate GPO settings on the local server? If so that won't work if your domain administrator sets a group policy.

Improve this answer
2
  • All I want to do is create a series of security groups that are local to the Windows Server. The groups must mimic the groups in active directory by name, and the users that are within them. I'm not looking to migrate any form of application/file/db form of policy, I just want to copy-and-paste the groups names and their users. I apologize if my request isn't clear. I'm primarily a WinForms/SQL Server developer. I've had to work in AD, as directed by my managers, for security within my apps. I can manually implement what I am trying to do but that will be very time consuming.
    – RLH
    Jun 15, 2011 at 19:30
  • Then what you asked will work, just recreate the groups and add the users you need.
    – ITHedgeHog
    Jun 15, 2011 at 19:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .