Updates to Restricted Groups ("Member of") behavior of user-defined local groups

Article translations Article translations
Article ID: 810076 - View products that this article applies to.
Expand all | Collapse all

On This Page

SUMMARY

In versions of Microsoft Windows earlier than Microsoft Windows 2000 Service Pack 4 (SP4), the Restricted Groups Member of security setting in Group Policy cannot be used to add domain groups to local groups on member computers. The Restricted Groups behavior was updated in Microsoft Windows 2000 SP4, Windows Server 2003 and newer releases. Microsoft Windows XP Service Pack 1 (SP1) requires a hotfix to update the Restricted Groups behavior, Windows Vista and newer have this update built-in. This article describes the changes to the feature.

MORE INFORMATION

With the Restricted Groups Member of functionality, you can now add domain groups to local groups. For more information about the Restricted Groups feature, including Members and Memberof descriptions, see "Restricted Groups" in the Windows Server product documentation.

Windows XP

Service pack information

To resolve this problem, obtain the latest service pack for Windows XP. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
322389 How to obtain the latest Windows XP service pack

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=support
Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language. The English version of this feature has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
   Date         Time   Version        Size     File name   Platform
   ----------------------------------------------------------------
   31-Jan-2003  02:53  5.1.2600.1163  849,408  Scesrv.dll  IA64
   31-Jan-2003  02:53  5.1.2600.1163  307,712  Scesrv.dll  i386

Adding Domain Groups to Local Groups

After you have verified that the feature is installed on all appropriate computers, you can use the Restricted Groups Member of setting to add a domain group to a local group (built-in or custom). You can define Member of policies for distinct groups in multiple Group Policy objects (GPOs) that are linked to any site, any domain, or any organizational unit (OU), and all the policies take effect. For example, as illustrated in the following table, you can create a policy that adds Domain Admins to the local Administrators group, and you can add a policy that adds My Management Admins group to the local Administrators group. This group is linked to a domain-level GPO. You can also create a policy that adds the My Organizational Unit Regional Admins group to the local Administrators group. This group is linked to an OU-level GPO. All policies are enforced.

Table 1: Adding domain groups to local groups
Collapse this tableExpand this table
Domain Group that you define a Restricted Groups policy for"Member of" entry: Local Group on member computersGPO level where the Restricted Groups policy is definedResult
Domain Admins (domain built-in)Administrators (local built-in)Domain levelAdministrators group contains Domain Admins, My Management Admins, and My Organizational Unit Admins
My Management Admins (domain custom)Administrators (local built-in)Domain levelAdministrators group contains Domain Admins, My Management Admins, and My Organizational Unit Admins
My Organizational Unit Regional Admins (regional OU custom)Administrators (local built-in)OU levelAdministrators group contains Domain Admins, My Management Admins, and My Organizational Unit Admins

Adding the same domain group to local groups across GPOs

If you create multiple Restricted Groups policies for the same group in multiple GPOs, only one policy will take effect. Restricted Groups policies for the same group do not merge across GPOs. The effective policy is determined by the order of the Group Policy processing. For information about Group Policy hierarchy and processing order, visit the following Microsoft Developer Network Web site:
http://msdn2.microsoft.com/en-us/library/aa374155.aspx
For example, as illustrated in the following table, two Restricted Group policies are defined for Domain Admins. One is defined at the domain level and adds Domain Admins to the local Administrators group. The other is defined at the OU level and adds the Domain Admins group to My Regional Division Admins. Domain Admins will only be added to My Regional Division Admins (by default, GPOs that are linked at the OU level override those that are defined at the domain level).

Table 2: Adding the same domain group to local groups across GPOs
Collapse this tableExpand this table
Domain Group for which you define a Restricted Groups policy"Member of" entry: Local Group on member computersGPO level where Restricted Groups policy is definedResult
Domain Admins (domain built-in)Administrators (local built-in)Domain levelBecause of how GPOs are processed, Domain Admins will only be added to the My Regional Division Admins group.
Domain Admins (domain built-in)My Regional Division Admins (local custom)OUBecause of how GPOs are processed, Domain Admins will only be added to the My Regional Division Admins group.

Domain controllers

In earlier versions of Windows, if a domain controller processes a Restricted Groups policy in which the Members section is left blank, all members are purged from the group when the policy is applied, regardless of the setting for Member of. For example, if you create a Restricted Groups policy at the domain level for Domain Admins with a blank Members section and if you included local Administrators in Member of, when the policy is applied, all members of the Domain Admins group are removed (including the built-in Administrator account), and an empty Domain Admins group is added to the local administrators group.

The behavior in Windows 2000 SP4, Windows XP with Service Pack 2 (SP2), and Windows Server 2003 has been corrected. On a computer that is running one of these versions of Windows, if you apply a Restricted Groups policy that defines Member of but leaves Members blank, the Members section is ignored, and group membership is not emptied.

If you plan to use the Restricted Groups functionality that is enabled by this update to configure domain controllers, member servers, or workstations, make sure that they are all running Windows 2000 SP4, Windows XP SP2, or Windows Server 2003 so that domain group membership is not modified unintentionally.

For member servers and workstations, the behavior in this scenario remains unchanged.

Applying "Members" and "Member of" Restricted Groups policies to a local group

It is best to define a Restricted Groups policy that adds a domain group to a local group and to define another Restricted Groups policy that restricts that local group’s membership. The final group membership of that local group cannot be predicted because the processing order of the two Restricted Groups policies is not defined. For example, as illustrated in the following table, if you create a Restricted Groups policy that adds Domain Admins to the local Administrators group and if you create a Restricted Groups policy that limits membership of the local Administrators group to the built-in Administrator account, you cannot predict if either policy will be enforced. If Domain Admins are added to the local Administrators group before the Administrators membership is limited, Domain Admins will be added to the local Administrators group and then removed. However, if the local Administrators group membership is limited before Domain Admins is added to the Administrators group, Domain Admins will remain in the local Administrators group.

Table 3: Adding a domain group to a local group with restricted membership
Collapse this tableExpand this table
Group that you define a Restricted Groups policy for"Members" entry"Member of" entry Resulting group membership
Domain Admins (domain built-in)NoneAdministrators (local built-in)You cannot predict the final group membership for the local Administrators group.
Administrators (local built-in)Administrator (local built-in)None You cannot predict the final group membership for the local Administrators group.
To get the membership that you want, use either Members or Member of Restricted Group policies exclusively. In the example in Table 3, to get the Administrators group membership that you want, add Domain Admins to the Members entry for the local Administrators group Restricted Groups policy.

Windows 2000

Service pack information

To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
260910 How to obtain the latest Windows 2000 service pack

Hotfix information

A supported feature that modifies the default behavior of the product is available from Microsoft. However, this feature is intended to modify only the behavior that this article describes. Apply this feature only to systems that specifically require it.

If the feature is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the feature.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific feature. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=support
Note The "Hotfix download available" form displays the languages for which the feature is available. If you do not see your language, it is because the feature is not available for that language. The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
 Date        Time     Version         Size       File name
 -------------------------------------------------------------
 07-Nov-2002  22:33   5.0.2195.6109    124,688   Adsldp.dll
 07-Nov-2002  22:33   5.0.2195.5781    131,344   Adsldpc.dll
 07-Nov-2002  22:33   5.0.2195.6109     62,736   Adsmsext.dll
 07-Nov-2002  22:33   5.0.2195.6052    358,160   Advapi32.dll
 07-Nov-2002  22:33   5.0.2195.6094     49,936   Browser.dll
 07-Nov-2002  22:33   5.0.2195.6012    135,952   Dnsapi.dll
 07-Nov-2002  22:33   5.0.2195.6076     96,016   Dnsrslvr.dll
 15-Nov-2001  23:27                      5,149   Empty.cat
 07-Nov-2002  22:33   5.0.2195.5722     45,328   Eventlog.dll
 07-Nov-2002  22:33   5.0.2195.6059    146,704   Kdcsvc.dll
 01-Nov-2002  18:52   5.0.2195.6112    204,048   Kerberos.dll
 21-Aug-2002  16:27   5.0.2195.6023     71,248   Ksecdd.sys
 07-Nov-2002  02:02   5.0.2195.6118    507,664   Lsasrv.dll
 07-Nov-2002  02:02   5.0.2195.6118     33,552   Lsass.exe
 27-Aug-2002  22:53   5.0.2195.6034    108,816   Msv1_0.dll
 07-Nov-2002  22:33   5.0.2195.5979    307,472   Netapi32.dll
 07-Nov-2002  22:33   5.0.2195.6075    360,720   Netlogon.dll
 07-Nov-2002  22:33   5.0.2195.6100    920,848   Ntdsa.dll
 07-Nov-2002  22:33   5.0.2195.6100    389,392   Samsrv.dll
 07-Nov-2002  22:33   5.0.2195.6120    130,320   Scecli.dll
 07-Nov-2002  22:33   5.0.2195.6120    303,888   Scesrv.dll
 07-Nov-2002  01:56   5.0.2195.6118    139,264   Sp3res.dll
 07-Nov-2002  00:05         5.3.9.0      4,096   Spmsg.dll
 07-Nov-2002  00:06         5.3.9.0     87,040   Spuninst.exe
 07-Nov-2002  22:33   5.0.2195.5859     48,912   W32time.dll
 04-Jun-2002  21:32   5.0.2195.5859     57,104   W32tm.exe
 07-Nov-2002  22:33   5.0.2195.6100    126,224   Wldap32.dll
 07-Nov-2002  02:02   5.0.2195.6118    507,664   Lsasrv.dll     --   56-bit 
For more information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the following article number to view the article in the Microsoft Knowledge Base:
265173 The Datacenter Program and Windows 2000 Datacenter Server product
For more information about how to install multiple Windows updates or hotfixes while restarting only once, click the following article number to view the article in the Microsoft Knowledge Base:
296861 How to install multiple Windows updates or hotfixes with only one reboot

Properties

Article ID: 810076 - Last Review: February 9, 2012 - Revision: 14.0
APPLIES TO
  • Microsoft Windows 2000 Service Pack 4
  • Microsoft Windows Server 2003 Service Pack 2
  • Windows Server 2008 Standard
  • Windows Server 2008 Enterprise
  • Windows Server 2008 R2 Standard
  • Windows Server 2008 R2 Enterprise
  • Microsoft Windows XP Professional
  • Windows Vista Business
  • Windows Vista Enterprise
  • Windows Vista Ultimate
  • Windows 7 Professional
  • Windows 7 Enterprise
  • Windows 7 Ultimate
Keywords: 
kbautohotfix kbhotfixserver kbqfe kbwinxpsp2fix kbsecurity kbwin2ksp4fix kbwin2000presp4fix kbfix KB810076

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com