Group membership changes overnight...

[Guest]

Hi,
accounts that are added to the Domain Admin's group get removed every night?
There are no error messages in the event log, only two DC's that are in sync,
but every night a new account that was added to the domain admin's group
loses it's membership. Very strange! Anyone have any ideas?

 

[Jerold Schulman]

Hi,
accounts that are added to the Domain Admin's group get removed every night?
There are no error messages in the event log, only two DC's that are in sync,
but every night a new account that was added to the domain admin's group
loses it's membership. Very strange! Anyone have any ideas?

I expect that you have Group Policy Restricted Groups implemented.

See tip 3251 » Group Policy Restricted groups.
in the 'Tips & Tricks' at http://www.jsifaq.com

See tip 5319 » How do I create a global group, so that it is a member of the local administrators group on all workstations and member servers, by using group policy restricted groups?