[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1322
  • Last Modified:

Local Administrator Group Policy Restriction

I have a forest with over 700 computers. The workstations have overtime had various local administrator groups and user added.

I used the restricted groups in Windows Computer Settings in the Group Policy editor and applied it to everybody in the forest.
I selected BUILTIN/ADMINISTRATORS and added ADMINISTRATOR and DOMAIN ADMINS to be the only local administrators.

That worked a treat. All the weird accounts were remove from the domain workstations and just Administrator and Domain Admins remain.

The problem is, I need to add 5 users to be allowed local administrator rights. But if I add them on the local machine, the group policy overides them.

How can I make exceptions to the Restrcited Groups policy?
0
darylclune
Asked:
darylclune
3 Solutions
 
Karl12347Commented:
Move the computer accounts to an OU on their own and then block inheritance of the group policy to that OU. This will stop the grou policy from being applied to only these computers and then you can manually add the users to the machine.

Hope this Helps
Karl
0
 
ms-proCommented:
try to make sperate group for your 5  users and add them to the gpo restriction policy.
0
 
Sinder255248Commented:
You could filter these machines on policy one.  Then create a new policy and instead of selecting the Local group as you did in the First policy, select the local user (or group with 5 users in) and then choose the "This group is a member of" button.  Put in the "This group is a member of" builtin\Administrators, and apply this policy.  Doing it this way round will not clear out the Administrators group as Policy one did, but will simply add the group, or individual users that you select.
0
Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

 
ms-proCommented:
@Karl12347 it's a long process.
He can create a new group with the 5 users, then he can add the group into the restrict policy, just like what he did with "domain admins".
with group restriction policy you can add multiple gorups to different local groups or domain gruops

http://support.microsoft.com/kb/810076.
0
 
Sinder255248Commented:
Sorry just noticed on my commend I've said "select local user (or group with 5 users in it)".  That should have read "select Domain User"

Ta

Bri
0
 
darylcluneAuthor Commented:
Awesome. Thanks
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now