Help needed using "Restricted Groups"

[Fran]

I'm told that I can assign a domain security group to be in the local
administrators group on domain client members by using the Restricted
Groups policy. I need to do just this (i.e. I have a ClientLocalAdmins
group that I have assigned help desk supervisor members to. I want to
apply a group policy that will enforce them being in every client PC's
Administrators group.)

I have tried doing this by placing the ClientLocalAdmins group into
the "Members in this group" on the Restricted Groups dialog. But
whether I put ADMINISTRATORS or anything else in the "Member of" group
nothing seems to take effect on the client side.

I have used GPUpdate on all the XP machines an the policy seems to
have no affect.

What am I doing wrong?

-Fran-

 

[Steven L Umbach]

See the link below to see if it helps at all. For Windows 2000 Restricted
Groups will not work right unless you have SP4 installed on them. Also
Restricted Groups is "computer configuration" so you want to configure it so
that the domain computers you want it to apply to are within the scope of
management of the GPO that has it configured. For domain computer you want
to do that at the OU level and NOT at the domain level or you will find the
group added to the administrators group for the domain also. It sounds like
you want your ClientLocalAdmins global group to use the "this group is a
member of" for the administrators group. Note that changes will not
propagate immediately. I suggest that you manually refresh Group
Policy/configuration on the domain controller where you configure Restricted
Groups and then reboot a domain workstation to see if the Restricted Group
policy works. On XP Pro computers you can also user rsop.msc to see the
effective Group Policy settings. --- Steve

http://support.microsoft.com/?id=811889