Welcome to Sign in | Join | Help
in Search

Richard's myITforum Blog

“After working at Microsoft for 5 years, I became the go-to-guy on various technologies and felt my focus shifting from SCCM. In my new role at SCCM Expert, I get to solely focus on SCCM 2007,” said Richard Dixon, Sr. Solutions Architect, SCCM Expert.

How to Add domain accounts to Local Administrators Group using GPO

There are a lot of questions in newsgroups, forums etc. about how to use Restricted Groups in the right way so I wanted to post a how-to for people to read.

Finding Restricted Groups is easy but it only works in a domain with Active Directory so trying to find it within your local GPO on your computer isn’t possible.

At first you right click on Restricted Groups and select “Add Group”.
What you get is the default window to choose a group, either from your domain or maybe from your local computer depending on what configuration you want.

Now you have two different choices of what you want to do with the group you selected. Either you use “Members of this group” or “This group is a member of”. The differences of these choices are big so I explain in two steps.

Members of this group

This is the choice you make when you want to add users to a group. What you select here is what you will see on your computers affected by this policy. So if you for example want to add a user to the local admin group on the computers then don’t forget to add administrator also or the administrator account will be removed from the local administrators group on the computers.

As an example can be this picture where you have both the local administrator account and also the built-in Authenticated Users group.

This group is a member of

This choice you can use if you want to add your selected group into another group. So what you can tell is that this is the opposite of what you defined in choice 1 described above. This is also not something that will override any other configuration you have done. So if you in first choice selected “Authenticated Users” and with this option select that it will be added to the “Administrators group” any other user you might have added to the group (manually perhaps) won’t be overwritten by this choice.

So this example which you can see in this picture will add the “Power Users group” into the “Administrators group”.

To summarize this it’s fairly easy to use Restricted Groups and it’s also the easiest way to add/remove users in groups and you can control it in a much better way than you ever can doing this manually. If you are doing this manually today it’s time to stop and using the right way instead.



Pages tagged "newsgroups" said:

Pingback from  Pages tagged "newsgroups"

June 17, 2008 11:10 PM

About rdixon

Certified on every release of SMS/SCCM product and now major focus is on NAP Implementations.

This Blog



SCCMNAP is a weblog and discussion forum dedicated to sharing, providing and bring together advanced expert knowledge from the technical community information related technologies for System Center Configuration Manager 2007 R2 & Network Access Protection. SCCMNAP shares industry standards and best practices from proven historical experience from mid to large size enterprises. SCCMNAP.COM Secure Your Environment!
Powered by Community Server (Commercial Edition), by Telligent Systems