Windows Server 2008: restricted groups, Managing local group membership with a GPO

Restricted groups are a little known option in an Active Directory Domain. They control local group membership on your active directory clients. In this video, I add a domain group to a local group without going to each and every local machine using group policy. This allows me to create membership for a specific group of people to a specific group on a specific group of computers. It's a great situation where I can make local admins or backup operators on a regional sect of computers. This feature is available onactive directory domains running Microsoft windows Server 2000, 2003, 2008. The client operating systems may include 2000, XP, Vista or 7.

Providing training videos since last Tuesday.
http://technoblogical.com
Thanks for watching.

Category:

Science & Technology

Tags:

• restricted
• groups
• local
• group
• member
• membership
• GPO
• policy
• active
• directory
• domain
• microsoft
• windows
• server
• 2000
• 2003
• 2008
• xp
• vista
• training
• technology
• electronics
• computers
• laptop
• software
• account
• tutorial
• instructions
• programs
• tips & tricks
• howto

[Highlander01]

Hello. Thanks for this tutorial. It's very helpful. At work, we have a group called "Staff" will all AD users in this group. I want the "Staff" group to be part of the local Administrators group. Would I just have to create a restricted group, using the Staff group, and put Administrators (local client admins) under the "This group is a member of" box? Thanks.

[technoblogical]

@Highlander01 Correct, but be very careful of how you use this. Don't inadvertently give the "Staff" group admin rights to your server by doing this to your Default Domain Group Policy or apply this to the Domain level instead of an OU. I'd consider making a new OU, adding all the desktop computers to a group in that OU, and then applying a restricted groups GPO to that OU.

[SHARK224]

May I know why did you choose window setting not a administrator template

[rjllv426]

thanks for posting!!

[Gothikon85]

Very helpful, thank you !

[Highlander01]

@technoblogical Yeah, it's ok. We have all our "staff" computers in its own OU, not at Domain level. Cheers.

[average124]

I do not think that your national group will ever show up. Restricted groups overwrite the existing. Please retest