Restricted group

[Guest]

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Hi,

How do I add one user to the local administrator group in ALL machines in
the domain using group policy? I DON'T want to remove other users who are
already in the local admin group. I know I have to do something with Member
Of but don't know how. Thanks

 

[Guest]

Archived from groups: microsoft.public.win2000.group_policy (More info?)

On Fri, 9 Jul 2004 22:58:16 -0700, "Chris Wagner" <so@hotmail.com> wrote:

>Hi,
>
>How do I add one user to the local administrator group in ALL machines in
>the domain using group policy? I DON'T want to remove other users who are
>already in the local admin group. I know I have to do something with Member
>Of but don't know how. Thanks
>
See http://support.microsoft.com?kbid=320065


Jerold Schulman
Windows: General MVP
JSI, Inc.
http://www.jsiinc.com

 

[Guest]

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Chris,

This cannot be done with existing Group Policy extensions. As you allude,
Restricted Groups policy replaces the group, so you lose existing
membership.

You would have to write a script (startup most likely due to permissions
requirements) to do something like this.

Regards,

Eric Voskuil
Policy Maker
http://www.autoprof.com/policy


"Chris Wagner" <so@hotmail.com> wrote in message
news:%239womLkZEHA.2016@TK2MSFTNGP09.phx.gbl...
> Hi,
>
> How do I add one user to the local administrator group in ALL machines in
> the domain using group policy? I DON'T want to remove other users who are
> already in the local admin group. I know I have to do something with
Member
> Of but don't know how. Thanks
>
>

 

[Guest]

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Startup script would work well. Try " net localgroup administrators domain\user /add
". Be very careful though, as if that script also runs on domain controllers, that
user will be added to the administrators group for the domain. --- Steve


"Eric Voskuil" <voskuil@online.autoprof.com> wrote in message
news:%23oEN81vZEHA.3480@TK2MSFTNGP11.phx.gbl...
> Chris,
>
> This cannot be done with existing Group Policy extensions. As you allude,
> Restricted Groups policy replaces the group, so you lose existing
> membership.
>
> You would have to write a script (startup most likely due to permissions
> requirements) to do something like this.
>
> Regards,
>
> Eric Voskuil
> Policy Maker
> http://www.autoprof.com/policy
>
>
> "Chris Wagner" <so@hotmail.com> wrote in message
> news:%239womLkZEHA.2016@TK2MSFTNGP09.phx.gbl...
> > Hi,
> >
> > How do I add one user to the local administrator group in ALL machines in
> > the domain using group policy? I DON'T want to remove other users who are
> > already in the local admin group. I know I have to do something with
> Member
> > Of but don't know how. Thanks
> >
> >
>
>

 

[Guest]

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Thanks for the help. Just wonder why MS doesn't think about this option with
restircted group.

"Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
news:HneIc.69499$Oq2.41108@attbi_s52...
> Startup script would work well. Try " net localgroup administrators
> domain\user /add
> ". Be very careful though, as if that script also runs on domain
> controllers, that
> user will be added to the administrators group for the domain. --- Steve
>
>
> "Eric Voskuil" <voskuil@online.autoprof.com> wrote in message
> news:%23oEN81vZEHA.3480@TK2MSFTNGP11.phx.gbl...
>> Chris,
>>
>> This cannot be done with existing Group Policy extensions. As you
>> allude,
>> Restricted Groups policy replaces the group, so you lose existing
>> membership.
>>
>> You would have to write a script (startup most likely due to permissions
>> requirements) to do something like this.
>>
>> Regards,
>>
>> Eric Voskuil
>> Policy Maker
>> http://www.autoprof.com/policy
>>
>>
>> "Chris Wagner" <so@hotmail.com> wrote in message
>> news:%239womLkZEHA.2016@TK2MSFTNGP09.phx.gbl...
>> > Hi,
>> >
>> > How do I add one user to the local administrator group in ALL machines
>> > in
>> > the domain using group policy? I DON'T want to remove other users who
>> > are
>> > already in the local admin group. I know I have to do something with
>> Member
>> > Of but don't know how. Thanks
>> >
>> >
>>
>>
>
>

 

[Guest]

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Then they'd have to rename the policy ;-).

Regards,

Eric Voskuil
Policy Maker
http://www.autoprof.com/policy


"Chris Wagner" <so@hotmail.com> wrote...
> Thanks for the help. Just wonder why MS doesn't think about this option
with
> restircted group.
>