Group Memberships via GPO. Restricted Groups or Control Panel Settings?

Reply to topic
4 posts
I need to set the membership of local groups on our clients. Specifically I need to ensure that a domain group is a member of local Administrators on a set of clients. These clients are a mix of Windows XP and Windows 7.

I see two places in group policy where I can do this: Restricted Groups (Computer Config/Windows Settings/Security Settings/Restricted Groups) and Local Users and Groups (Computer Config/Preferences/Control Panel Settings/Local Users and Groups).

Both settings appear to do the same thing: They can add or remove members of local groups. If I want to make sure one user is an admin on all boxes, or I want to ensure that a particular group never gets added to Remote Desktop Users, or I want a subset to be in the Power Users group; both of these GPO settings can accomplish that.

In that case, what's the difference?
If you use Restricted Groups, ONLY the groups you set in the GPO can be made members of the specified group. By using Preferences, you can add users/groups, but other users with administrative rights can still add other users/groups to the specified group. Use Restricted Groups if you want the group membership totally dictated by the GPO settings, otherwise use Preferences.
Thanks. I did some further research which confirmed your reply: Restricted groups really, truly *restricts* the group membership. The group will contain those members no matter what any local settings say.

Local Users and Groups, by contrast, *adjusts* the group membership. You can add or remove members. You can set it to remove all other members of the local group, thus making it as restrictive as Restricted Groups. But that settings is optional. Thus it's much more flexible than Restricted Groups.

The only reason I see to keep using Restricted Groups is that Local Users and Groups GPOs don't affect my Windows XP boxes. The sooner we can get rid of those, the sooner we can start using the better GPO settings.
If you install the Group Policy Preferences Client Side Extensions on your Windows XP boxes, it will respect the Local Users and Groups preference item. We use preferences at work to add some admin accounts to all desktops, but we didn't want to go so far as to implement restricted groups or remove existing members because we didn't know what would break if certain users who were admins were suddenly not. In our case, a thorough analysis would need to be done to determine who still has local admin rights but shouldn't, and what changes will need to be made to remove those rights without breaking functionality for the user, before we implement that feature. I agree that using Preferences is much more robust. ... px?id=3628
4 posts