Was trying to create a gpo in the domain controllers ou to change the buildin\administrators group uaing restricted groups but decided against it and impressively clicked ok instead of cancel and it set administrators group to none on the primary DC and replicated almost instantly. Is there any fix to disable this gpo without doing a dcrestore? I am pretty sure noone in this environment knows the password that was set when the DC was promoted.


Because the use of Restricted Groups was intended to manage the membership of local security groups and not domain security groups (which isn't supported by Microsoft), you normally could reverse the effect by removing the Restricted Group from the GPO or unlinking the GPO altogether, which will set the group membership back to the state it was in prior to you configuring it via GPO. Because you did this for the Builtin\Administrators domain group I'm not sure what the outcome will be but if you still have access to the GPO you might try that to see if it resolves the issue.

  • No access to the domain controllers immediately after this GPO went into effect. Cannot edit the GPOs remotely, cannot do anything in AD. Setup a small virtual environment at home and recreated the exact GPO in the domain controllers OU and cannot seem to replicate the issue. – Nick W. Mar 2 '18 at 0:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.