The following scenario is weird. Please be advised.

I have created a GPO on an OU containing workstations like this:

enter image description here

This GPO purpose is to make the Backup Operators group a member of the local Administrators group on all the workstations inside the OU.

enter image description here

Here is the content of this GPO:

enter image description here

Then when I check if the GPO is applied using gpresult on a workstation inside the Organisational Unit (OU) on which the GPO is applied, I can see that it is correctly applied on that workstation:

enter image description here

But when I go check in the local group on the workstation, in the local Administrators group, I should see the Backup Operators group inside it, but no:

enter image description here

Even after a gpupdate /force followed by a reboot, I end up with the same result.

Have I done something wrong?


This is what I get in the Event Viewer after I do a gpudpate /force:

Security policies were propagated with warning. 0x4b8 : An extended 
error has occurred.

For best results in resolving this event, log on with a 
non-administrative account and search http://support.microsoft.com 
for "Troubleshooting Event 1202's".
  • Have you checked the event viewer of the machine to check for errors? Secondly, try running the GUI Group Policy Results from the DC. – Dan Dec 20 '11 at 14:17
  • I'v added a warning message I got in the Event Viewer. This warning message is not really helpful though. – Jonathan Rioux Dec 20 '11 at 14:24

Heh, you're going to slap yourself !

"Backup Operators" is a built-in Domain Local security group.

As per my aging MCSE, a domain local security group cannot be a member of another group.

It is a so-called "endpoint" group and can only apply to DACLs and the like.

  • If GPResult is showing the policy then surely it has met the security requirements? – Dan Dec 20 '11 at 14:17
  • Now you also know where the error comes from: attempting to add a DL group to another group :) – adaptr Dec 20 '11 at 16:09
  • I think it's useful to take a look at the clarification in the answer from @user95587. – aculich Dec 20 '11 at 21:57

While I agree ultimately with @adaptr, this cannot be done, some clarification of terminology may be helpful.

You can create domain local security groups and nest them. It may depend on domain function level (ours is 2000, not very current) and it may depend on server version (we run 2003/2008R2) but it can be done.

However MS default builtin groups, both local and domain, have restricted nesting.

"You cannot add the default groups that are located in the Builtin container as members to other groups. However, you can add other groups as members to the default groups that are located in the Builtin container."


Both the Administrator and Backup Operators groups are in the domain Builtin OU, this would appear to apply to clients (local users and groups) as well.

  • I think you mean no nesting there. – adaptr Dec 21 '11 at 8:51
  • @adaptr - For the default builtin groups, nesting is a one way "add". I view that as limited or restricted but not completely disallowed. – user95587 Dec 22 '11 at 17:40

Seems backwards to me. I've always added the "Administrators" group to the restricted groups GPO and added the appropriate members. Keep in mind, this will overwrite what's there so make sure you add domain admins back in.

Actually, is there another GPO that's adding Domain admins to the Administrators group? That could be overwriting this GPO if applied after. For example, the default domain policy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.