Using Server 2012 r2 in domain environment, I'm trying to add specific groups of users to the Administrators(local)group to computers organized in OUs using GPP and item-level targeting.
While the GPO shows that it is applying(via gpresult), the Administrators group membership doesn't change. I've even placed a test OU at top of domain and disabled inheritance. I know I can use restricted groups, but it'll be a pain for the set of scopes we need. To test this, I've set restricted groups up in the same GPO and it works fine.
Long story short, can GPP's actually be used to set local Administrators membership?
Update: Testing has provided the following results;
- In the OU tree if I have a restricted group set higher up, that change takes effect.
If I place a restricted group setting in the same GPO, that change takes effect. (Follows proper LSDOU order)
Most interesting part: When I try to use GPP, I can change the local Administrators group description but membership doesn't change.
I know that semi-recently(within last year or so) MS rolled out an update that disabled the ability to change local admin passwords via GPO, anyone know if it also broke this GPP ability too? Or alternatively, is anyone using this to set groups with an updated version of 2012 R2?