In a heavily branched organization with Active Directory, I am working with the head IT department and we are delegating control to parts of the branch OU to the respective branch admins.

Our delegation concept currently handles group policies in a way that we create one group policy object under control of the head IT and one group policy object delegated to the branch admin for each of the branches, both linked on the same level to the branch OU, with the -head GPO getting the Enforced flag and the Link Order of 1.

When defining local groups (usually just pre-defined groups like Administrators or Remote Desktop Users) we are facing the problem that it is rather tricky to delegate. The ultimate goal is to have whatever the -head GPO has defined in the group and merge in the -branch membership definitions. We are defining local groups via GPP in -head like this: GPP head

We are flushing the group memberships to make sure that group members which have been added once via the GPP but removed since are actually removed from the clients' local groups.

The same group might have membership definitions made via GPP in -branch:

GPP branch

Now the result is, that only -head's definition is ultimately present on the affected clients. We get pretty much the same result when using Restricted Groups instead of GPPs as the Enforced link flag is giving the -head GPO preference over the -branch. And when mixing Restricted Groups on -head with GPPs on -branch, we are seeing inconsistent results - depending on which CSE is running first (apparently the order of execution for CSEs is undefined), groups might or might not contain GPP-defined members from -branch.

So what would be the most sensible way to enforce certain memberships centrally while still allowing for delegation to the branch admins?

  • Do you get the same result if you un-check Delete all member users and Delete all member groups from the -head GPP? – Josh Oct 7 '15 at 16:22
  • @JoshR no I don't - if I do not delete members, the merge seems to succeed. The downside is that without clearing the group's members, the branch admins experience the very counterintuitive behavior that entries removed from the members list in the GPP will not be removed from the clients' group membership lists. We are expecting difficulties communicating a more sophisticated procedure to the branch admins (e.g telling them to set the action to "REMOVE" instead of simply removing the membership from the GPP). Having a clean slate is also a good thing to have for administrative definitions. – the-wabbit Oct 9 '15 at 9:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.