Removing Restricted Groups

[Guest]

Hello,

I have inherited a Windows 2000 domain and I am trying to clean up the group
policy. Under Computer Configuration; Windows Settings; Security Settings;
Restricted groups for my Default Domain Policy, I have an entry restricting
the Domain Admin’s group to certain people. This is causing a problem since
the domain 'administrator' account is not in there and when the policy gets
enforced, it tries to remove the admin for the Domain Admin’s group. Luckily
AD won’t let it because of the primary group, but I'm wondering if I can
remove this restricted group all together? Is it a default entry? Can
anyone thing of some adverse affects?

Thanks,

-Steve

 

[Jerold Schulman]

Hello,

I have inherited a Windows 2000 domain and I am trying to clean up the group
policy. Under Computer Configuration; Windows Settings; Security Settings;
Restricted groups for my Default Domain Policy, I have an entry restricting
the Domain Admin’s group to certain people. This is causing a problem since
the domain 'administrator' account is not in there and when the policy gets
enforced, it tries to remove the admin for the Domain Admin’s group. Luckily
AD won’t let it because of the primary group, but I'm wondering if I can
remove this restricted group all together? Is it a default entry? Can
anyone thing of some adverse affects?

Thanks,

-Steve

It is not a default entry and can be removed.
See tips 3251 and 5319 in the 'Tips & Tricks' at http://www.jsifaq.com