Solved

How do Restricted Groups work within multiple GPOs?

Posted on 2010-08-31
3
1,433 Views
Last Modified: 2012-05-10
Let's say an OU has two GPOs applied to it. One at that level, one from a parent.

If parentGPO contains three groups that have restricted groups with members, how are restricted groups in the childGPO handled? For example:

1. If I add only one restricted group to that childGPO, does it add that restricted group to the total list of restricted groups (and replace any in the parentGPO if they match)?
2. Or does it replace the list of restricted groups for all computers in that childOU and below with only the list in the childGPO?

Lastly, are restrictued groups basically the list of groups that are local to a PC that you want to control the membership of? What happens in the case of matching names? For example we want to control via restricted groups who can RDP to the member workstations and servers, but also control who can RDP to the domain controllers. I realize under User Rights I can specify groups or users individually, but I was hoping to just use groups and then use group membership to further manage who has that right. In the case of Remote Desktop Users, this is a domain group as well as the name for the local PC group.

Thanks!
0
Comment
Question by:MrSampsonite
  • 2
3 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 500 total points
Comment Utility
So for those not familiar with restricted groups see
http://www.frickelsoft.net/blog/?p=13
If you use the top box "memboers of this group"  that will wipe what is there and replace it with what you define.   So the GPO that would take precedence is at the OU level (childGPO would win in your example and that is what would be defined)
If  you use the bottom box "this group is a memberof" then it would be cumulative meaning that what you added in parentGPO would be there and the groups defined in childGPO would also be added....non destructive
As far as restricted groups for domain group membership on a DC...not supported
http://support.microsoft.com/kb/279301
Managing membership of Domain Groups by using Restricted Groups

Microsoft does not support using Restricted Groups in this scenario. Restricted Groups is a client configuration means and cannot be used with Domain Groups. Restricted Groups is designed specifically to work with Local Groups. Domain objects have to be managed within traditional AD tools. Therefore, we do not plan currently to add or support using Restricted Groups as a way to manage Domain Groups.
 Thanks
Mike
0
 

Author Comment

by:MrSampsonite
Comment Utility
Thanks. That explains how it works for one GPO, but it doesn't really answer how the two GPOs would result in. If I add a group to be a member of a local group in the GPO and then add another group in a subOU GPO (childGPO), will that group get added as well as the one from the parentGPO or will only that group from the childGPO be added to the local group on the PC?

Likewise what would happen if you set the list of users who are members of this local group at one level and then at a childGPO level? I realize from the blog that the GPOs would wipe out any settings at the local PC level for members, but will the childGPO wipe out the parent settings too or will both merge and push down? I'm guessing the childGPO wipes it out, otherwise how would a childOU of computer objects be able to force only certain members for that group if a parentGPO's members were being added.

Last question is this:

When adding the Remote Desktop Users group to the restricted group list, how do you make sure you're adding the local group for each PC and not the domain group with the same name?
0
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 500 total points
Comment Utility
Yes if you use the bottom box the groups you define in all the GPOs will all be added. (parent and child GPOs)

The second one the child would win and wipe out all the parent members (haven't tested that, I have tested the first scenario and that is what we do in our domain)

when you select the group use computername\group
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Installing a printer using group policy preferences is not that hard let’s take a look at it. First lets open up your group policy console and edit the policy you want to add it to. I recommend creating a new policy for each printer makes it a l…
In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now