Change Local Security through GPO

[cygnetrower1]

I'd like to change the the local security settings on all client PCs to add a new domain secuirty group to their local administrator group. This is so I can remove the help desk users from Domain Admins but still allow them to support client Pcs. (all pcs are win2000/xp)

I'm sure I can do this via a GPO and so control it through AD but haven't been able to work out how.

Can anyone help ?.

 

[svsawkar]

What part are you stuck on? How to configure GP's in general, finding the correct policy or having the policy not being enforced once it hits the desktop?

Sounds like Restricted Groups may be your solution, but we need more info!

/Siddharth

 

[cygnetrower1]

This is what I have done so far.
Created a new Domain Global Group and added the required users to it.
Created an OU and moved some tests PC's into it
Created a GPO for this OU in computer configuration\windows settings\restricted groups adding the domain global group

I thought this should do it.
The GPO runs on the PC - I can see that it has in the event log but new group has not been added to the local administrators group.

 

[svsawkar]

So in your event log on the client machines, you are seeing SceCli 1704 (successfully processed group policy)?

/Siddharth

 

[cygnetrower1]

Yes, that's the message.

Can you see if i have missed anything ?

Damian.

 

[xmsre]

Restricted groups LIMIT the membership to specific named members or groups. I don't think the intent was to POPULATE.

It will strip members/groups not on the list from the membership of the restricted group on policy refresh.

Try using cusrmgr.exe from the w2k reskit to populate the local admininstrators group on each workstation remotely.

John
MOSMWNMTK

 

[svsawkar]

It will strip and re-populate the group with who you want. Should work fine if configured correctly.

228496 HOW TO: Use Restricted Groups in Windows 2000

http://support.microsoft.com/?id=228496

From the article:
Membership Is Strictly Enforced:

- For the restricted group, any user or group that is included in that restricted group's member list is added to the group.

- Any user or group that is currently a member of the group, but is not listed in the restricted group's member list is removed.

So you get both.

/Siddharth