Removing Restricted Groups

[Guest]

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Hello,

I have inherited a Windows 2000 domain and I am trying to clean up the group
policy. Under Computer Configuration; Windows Settings; Security Settings;
Restricted groups for my Default Domain Policy, I have an entry restricting
the Domain Admin’s group to certain people. This is causing a problem since
the domain 'administrator' account is not in there and when the policy gets
enforced, it tries to remove the admin for the Domain Admin’s group. Luckily
AD won’t let it because of the primary group, but I'm wondering if I can
remove this restricted group all together? Is it a default entry? Can
anyone thing of some adverse affects?

Thanks,

-Steve

 

[Guest]

Archived from groups: microsoft.public.win2000.group_policy (More info?)

On Thu, 12 May 2005 10:11:05 -0700, "Steve N" <SteveN@discussions.microsoft.com> wrote:

>Hello,
>
>I have inherited a Windows 2000 domain and I am trying to clean up the group
>policy. Under Computer Configuration; Windows Settings; Security Settings;
>Restricted groups for my Default Domain Policy, I have an entry restricting
>the Domain Admin’s group to certain people. This is causing a problem since
>the domain 'administrator' account is not in there and when the policy gets
>enforced, it tries to remove the admin for the Domain Admin’s group. Luckily
>AD won’t let it because of the primary group, but I'm wondering if I can
>remove this restricted group all together? Is it a default entry? Can
>anyone thing of some adverse affects?
>
>Thanks,
>
>-Steve

It is not a default entry and can be removed.
See tips 3251 and 5319 in the 'Tips & Tricks' at http://www.jsifaq.com