I need to remove users from the Local Administrators group - it's built up a lot of them over time. So I have created a temporary Organizational Unity with a temporary GPO attached to it, and I've used Restricted Groups to populate the local admin group with the required groups.

When a PC is moved into the temporary OU, the GPO is applied and the local admin group is changed (users removed). When the PC is moved back to the original OU and the test policy is no longer applied, it reverts back to the original members of the local admin group.

How can I make the changes to the members of the Local Administrators group persist even when the GPO that caused those changes no longer applies? I want to be able to move the PC back to its original OU and have it keep the new, shorter list of Local Administrators.

For context, I'm using a temp OU to control/test the removal of local admin privileges on our applications.


What you describe is by design. Policies only take effect when the currently apply to an object. (There are exceptions, e.g. software deployment).

If you must use a restrictive groups policy to achieve this, then linking the policy to the original OU is your only option.

If you don't want the policy to target all computers in the original OU, you can place security filtering on the policy to only include specific computers.

| improve this answer | |
  • WMI filtering can also be used to limit which machines within the original OU are affected. I've found WMI to be easier to deal with as it's more dynamic and machines that meet the filter's requirements are automatically included or excluded instead of having to manually control group membership. – mrdenny Mar 18 '12 at 22:13

I was experimenting with Group Policy Preferences for a similar end.

You would definitely need to test this before use but I am fairly sure you can use a GPP managing the local Administrators group with a 'Replace' option set. Just be sure that you include all of the accounts you want to retain and you don't use the option to the remove the settings when system is out of scope.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.