0

I am not "allowed" to add users directly to the administrators or remote desktop user groups due to internal reasons (This is all local).

I have successfully created the new local group and added my users to that. I then successfully added my new local group to the administrator and remote desktop users group. (Again, still local).

Even though I have created the new local group, added the users to that new group, then added that new local group the administrator and remote desktop users group, I cannot seem to do things like RDP. (I personally am not that great when it comes to local group inheritance)

Improve this question
6
  • Why not try it?
    – Dan
    Feb 11, 2016 at 18:15
  • @Dan Try what? Rather vague response. I have tried to add the group to administrators as well as remote desktop users groups, and that works for the add. However they don't inherit the perms of those groups (ie. I cannot rdp with a user in this new local group even though it is a member of administrators and remote desktop users). Please try to provide constructive feedback in the future. Thank you.
    – beardedeagle
    Feb 11, 2016 at 18:17
  • This is a bit of an x-y question. You've asked about y (group inheritance) but it seems like your actual problem is x (how do I give users the correct permissions to rdp)
    – Drifter104
    Feb 11, 2016 at 19:34
  • @Drifter104 well the users in the group yes, I can't really add them directly to each group for internal reasons.
    – beardedeagle
    Feb 11, 2016 at 19:34
  • You should probably reword the question - tell us what you want the users to be able to do, why you can't add the users to the groups you think will resolve the problem and explain what you have already done (which is really what you have done above)
    – Drifter104
    Feb 11, 2016 at 19:37

1 Answer 1

Reset to default
1

I would answer based on the assumption that you're testing this on a local workstation machine that is not connected to a domain, or that the groups you're working with are created on a local machine .

Having said that, I'm still puzzled on how did you manage to add a local group, to a local admins group or the RDP local group. What you have done is not a supported scenario and it should not work based on the Microsoft documentation here: https://technet.microsoft.com/en-us/library/ee681621(v=ws.10).aspx

The correct way to do this is to use the Microsoft AGDLP recommendation to assign permissions, which is summarized very nicely here: https://en.wikipedia.org/wiki/AGDLP

Improve this answer
2
  • For whatever reason ([ADSI]"WinNT://$servername/Administrators,group").Add("WinNT://$servername/$groupname") worked on local groups. I assume what is happening is that this is supposed to be for AD groups to add to local groups, but it does no checking and thus just allows it.
    – beardedeagle
    Feb 11, 2016 at 22:03
  • There is your problem then, what you're doing just doesn't work unfortunately, you'll have to use a domain group to enable group nesting to work.
    – Noor Khaldi
    Feb 11, 2016 at 22:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .