Updates to Restricted Groups ("Member of") behavior of user-defined local groups

In versions of Microsoft Windows earlier than Microsoft Windows 2000 Service Pack 4 (SP4), the Restricted Groups Member of security setting in Group Policy cannot be used to add domain groups to local groups on member computers. The Restricted Groups behavior was updated in Microsoft Windows 2000 SP4, Windows Server 2003 and newer releases. Microsoft Windows XP Service Pack 1 (SP1) requires a hotfix to update the Restricted Groups behavior, Windows Vista and newer have this update built-in. This article describes the changes to the feature.

With the Restricted Groups Member of functionality, you can now add domain groups to local groups. For more information about the Restricted Groups feature, including Members and Memberof descriptions, see "Restricted Groups" in the Windows Server product documentation.

Windows XP

Service pack information

To resolve this problem, obtain the latest service pack for Windows XP. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language. The English version of this feature has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Adding Domain Groups to Local Groups

After you have verified that the feature is installed on all appropriate computers, you can use the Restricted Groups Member of setting to add a domain group to a local group (built-in or custom). You can define Member of policies for distinct groups in multiple Group Policy objects (GPOs) that are linked to any site, any domain, or any organizational unit (OU), and all the policies take effect. For example, as illustrated in the following table, you can create a policy that adds Domain Admins to the local Administrators group, and you can add a policy that adds My Management Admins group to the local Administrators group. This group is linked to a domain-level GPO. You can also create a policy that adds the My Organizational Unit Regional Admins group to the local Administrators group. This group is linked to an OU-level GPO. All policies are enforced.

Table 1: Adding domain groups to local groups

Adding the same domain group to local groups across GPOs

If you create multiple Restricted Groups policies for the same group in multiple GPOs, only one policy will take effect. Restricted Groups policies for the same group do not merge across GPOs. The effective policy is determined by the order of the Group Policy processing. For information about Group Policy hierarchy and processing order, visit the following Microsoft Developer Network Web site:For example, as illustrated in the following table, two Restricted Group policies are defined for Domain Admins. One is defined at the domain level and adds Domain Admins to the local Administrators group. The other is defined at the OU level and adds the Domain Admins group to My Regional Division Admins. Domain Admins will only be added to My Regional Division Admins (by default, GPOs that are linked at the OU level override those that are defined at the domain level).

Table 2: Adding the same domain group to local groups across GPOs

Domain controllers

In earlier versions of Windows, if a domain controller processes a Restricted Groups policy in which the Members section is left blank, all members are purged from the group when the policy is applied, regardless of the setting for Member of. For example, if you create a Restricted Groups policy at the domain level for Domain Admins with a blank Members section and if you included local Administrators in Member of, when the policy is applied, all members of the Domain Admins group are removed (including the built-in Administrator account), and an empty Domain Admins group is added to the local administrators group.

The behavior in Windows 2000 SP4, Windows XP with Service Pack 2 (SP2), and Windows Server 2003 has been corrected. On a computer that is running one of these versions of Windows, if you apply a Restricted Groups policy that defines Member of but leaves Members blank, the Members section is ignored, and group membership is not emptied.

If you plan to use the Restricted Groups functionality that is enabled by this update to configure domain controllers, member servers, or workstations, make sure that they are all running Windows 2000 SP4, Windows XP SP2, or Windows Server 2003 so that domain group membership is not modified unintentionally.

For member servers and workstations, the behavior in this scenario remains unchanged.

Applying "Members" and "Member of" Restricted Groups policies to a local group

It is best to define a Restricted Groups policy that adds a domain group to a local group and to define another Restricted Groups policy that restricts that local group’s membership. The final group membership of that local group cannot be predicted because the processing order of the two Restricted Groups policies is not defined. For example, as illustrated in the following table, if you create a Restricted Groups policy that adds Domain Admins to the local Administrators group and if you create a Restricted Groups policy that limits membership of the local Administrators group to the built-in Administrator account, you cannot predict if either policy will be enforced. If Domain Admins are added to the local Administrators group before the Administrators membership is limited, Domain Admins will be added to the local Administrators group and then removed. However, if the local Administrators group membership is limited before Domain Admins is added to the Administrators group, Domain Admins will remain in the local Administrators group.

Table 3: Adding a domain group to a local group with restricted membershipTo get the membership that you want, use either Members or Member of Restricted Group policies exclusively. In the example in Table 3, to get the Administrators group membership that you want, add Domain Admins to the Members entry for the local Administrators group Restricted Groups policy.

Windows 2000

Service pack information

To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Hotfix information

A supported feature that modifies the default behavior of the product is available from Microsoft. However, this feature is intended to modify only the behavior that this article describes. Apply this feature only to systems that specifically require it.

If the feature is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the feature.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific feature. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the feature is available. If you do not see your language, it is because the feature is not available for that language. The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
For more information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the following article number to view the article in the Microsoft Knowledge Base: For more information about how to install multiple Windows updates or hotfixes while restarting only once, click the following article number to view the article in the Microsoft Knowledge Base: