Security Restrictions in GPO

[Guest]

I'm trying to use security restrictions to run a particular GPO on a handful
of computers in my domain. The small group will change over time, but it
will always be a small group, so this seemed to be the easiest way to do it.

However, when I test this in the lab, it doesn't work as expected. It works
for the systems in my restricted list, but if I pull a system out, the GP
setting is still active for the removed computer, even after doing a gpupdate
/force and a cold boot.

All I'm doing is adding a particular domain group to the local
administrators group. The domain group does not get removed if you remove a
test computer from the restriction list.

I removed Authenticated Users from the restriction list. It's just
computers my AD domain.

Bug or feature ?

KH

 

[Jerold Schulman]

I'm trying to use security restrictions to run a particular GPO on a handful
of computers in my domain. The small group will change over time, but it
will always be a small group, so this seemed to be the easiest way to do it.

However, when I test this in the lab, it doesn't work as expected. It works
for the systems in my restricted list, but if I pull a system out, the GP
setting is still active for the removed computer, even after doing a gpupdate
/force and a cold boot.

All I'm doing is adding a particular domain group to the local
administrators group. The domain group does not get removed if you remove a
test computer from the restriction list.

I removed Authenticated Users from the restriction list. It's just
computers my AD domain.

Bug or feature ?

KH

See tip 3251 » Group Policy Restricted groups.
in the 'Tips & Tricks' at http://www.jsifaq.com

See tip 5319 » How do I create a global group, so that it is a member of the local administrators group on all workstations and member servers, by using group policy restricted groups?

Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
http://www.jsifaq.com