Windows Server 2008: restricted groups, Managing local group membership with a GPO

[SHARK224]

May I know why did you choose window setting not a administrator template

[rjllv426]

thanks for posting!!

[Gothikon85]

Very helpful, thank you !

[Highlander01]

Hello. Thanks for this tutorial. It's very helpful. At work, we have a group called "Staff" will all AD users in this group. I want the "Staff" group to be part of the local Administrators group. Would I just have to create a restricted group, using the Staff group, and put Administrators (local client admins) under the "This group is a member of" box? Thanks.

[technoblogical]

@Highlander01 Correct, but be very careful of how you use this. Don't inadvertently give the "Staff" group admin rights to your server by doing this to your Default Domain Group Policy or apply this to the Domain level instead of an OU. I'd consider making a new OU, adding all the desktop computers to a group in that OU, and then applying a restricted groups GPO to that OU.

[Highlander01]

@technoblogical Yeah, it's ok. We have all our "staff" computers in its own OU, not at Domain level. Cheers.

[average124]

I do not think that your national group will ever show up. Restricted groups overwrite the existing. Please retest