Restricted Groups work for non builtin groups?

[Joe]

I have been trying to use the Restricted groups functionality of GPOs to
create my own local group and add specific users to it. In the same policy
object, I also have another restricted group specified that happens to be a
builtin group (Remote Desktop Users in this case). The restricted group
policy for Remote Desktop users works as expected, but the other "custom"
group never gets created.

I know the policy is getting applied to this machine (server 2003 R2 member
server) because the remote desktop users group is correctly editted.

I havent seen anything anywhere that talks about whether Restricted Groups
only works for builtins, or should apply to user created groups.

Should it work for user created groups?

Thanks for any info,

Joe

 

[Jerold Schulman]

I have been trying to use the Restricted groups functionality of GPOs to
create my own local group and add specific users to it. In the same policy
object, I also have another restricted group specified that happens to be a
builtin group (Remote Desktop Users in this case). The restricted group
policy for Remote Desktop users works as expected, but the other "custom"
group never gets created.

I know the policy is getting applied to this machine (server 2003 R2 member
server) because the remote desktop users group is correctly editted.

I havent seen anything anywhere that talks about whether Restricted Groups
only works for builtins, or should apply to user created groups.

Should it work for user created groups?

Thanks for any info,

Joe

See tip 3251 » Group Policy Restricted groups.
in the 'Tips & Tricks' at http://www.jsifaq.com

Your problem is that Restricted Groups does not create groups, it just manages
membership.

You need to pre-create the group on the client computer.
Try
net localgroup "Group name" /add
in a startup script.

Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
http://www.jsifaq.com