Local Users and Groups

I wold like to enable a group policy that only the follow X administrators will be added to the local machine administrator group and no user.  
I noticed the GPO - User Configuration - Local Users and Group - Admnistrators Built-n

attached. would be correct and add the members into the admin area.
Who is Participating?
SandeshdubeyConnect With a Mentor Senior Server EngineerCommented:
Ensure that restricted group policy is configured correctly else it will not only add required members to local Administratiors, but it will remove any members that were in local Admins previously.You need to select the bottom box under "This Group is a member of," so it won't wipe out current members on all machines.http://www.frickelsoft.net/blog/?p=13
Joseph MoodyBlogger and wearer of all hats.Commented:
You will probably want to use Restricted groups.

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

shorisAuthor Commented:
ok what about the policy I have uploaded, what does this do ? does it not disable any user account to be added to the Local Admin group on the workstation?
Joseph MoodyConnect With a Mentor Blogger and wearer of all hats.Commented:
That would be a group policy preference - it is used to add users to groups and is normally placed in the computer configuration node.

Most people use restricted groups because they are more secure than preferences. They will undo changes made manually by an administrator (such as a staff member adding another staff member to the local admins group)
shorisAuthor Commented:
ok but in a nutshell the policy above would be still considered ok since we are making sure that users are not allowed in the Local Admin group but an Admin can add them in and that's ok I do want some flexibility.

Would that be correct?
Joseph MoodyBlogger and wearer of all hats.Commented:
I would put it on the computer side. preferences will work for what you want to do.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.