Restricted Groups

[Guest]

I was wondering if it was possible to use GP and restricted groups to add a
global group to the local administrators group of every workstation in a
domain?

 

[Brian Desmond [MVP]]

Yep. You'd want to do this in the default domain policy, ro a policy that is
linked to the domain. Keep in mind that a restricted group will overwrite
the contents of hte existing group. If you need to preserve group membership
and just add you rglobal group, a simple startup script would be a better
choice.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com

 

[Cary Shultz [A.D. MVP]]

Or, you could simply make use of the patch for this. Brian is absolutely
correct in that - out of the box - the use of Restricted Groups flushes the
current members out of the local group and then puts in 'your' group.
However, if you apply the patch ( but you have to do this to each and every
computer in the network ) then you keep the current membership and simply
'add to' it with 'your' group.

Please take a look at the following two MSKB Articles:

http://support.microsoft.com/?id=320065
http://support.microsoft.com/?id=810076

HTH,

Cary