Parent domain administrator question

S

Scott

When adding a computer into a child domain, only the child domain admin
group gets added to the local administrator account. Anyone know how I can
add the parent domain admin account as well, automatically?
 
T

Tim Hines [MSFT]

That behavior is hardcoded and can't be changed but you could setup a group
policy that will add the parent admin group to the local admin group. Use
"restricted groups" to do this. I've pasted a description of this policy
setting below

Restricted Groups
Computer Configuration\Windows Settings\Security Settings\Restricted Groups

Description
Restricted groups allow an administrator to define two properties for
security-sensitive groups (that is, "restricted" groups).

The two properties are Members and Member Of. The Members list defines who
should and should not belong to the restricted group. The Member Of list
specifies which other groups the restricted group should belong to.

When a restricted Group Policy is enforced, any current member of a
restricted group that is not on the Members list is removed. Any user on the
Members list which is not currently a member of the restricted group is
added.

Note

The Restricted Groups folder is available only in Group Policy objects
associated with domains, OUs, and sites. The Restricted Groups folder does
not appear in the Local Computer Policy object.

If a Restricted Group is defined such that it has no members (that is, the
Members list is empty), then all members of the group are removed when the
policy is enforced on the system. If the Member Of list is empty no changes
are made to any groups that the restricted group belongs to. In short, an
empty Members list means the restricted group should have no members while
an empty Member Of list means "don't care" what groups the restricted group
belongs to.


--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top