Summary
In versions of Microsoft Windows earlier than Microsoft Windows 2000 Service Pack 4 (SP4), the Restricted Groups Member of security setting in Group Policy cannot be used to add domain groups to local groups on member computers. The Restricted Groups behavior was updated in Microsoft Windows 2000 SP4, Windows Server 2003 and newer releases. Microsoft Windows XP Service Pack 1 (SP1) requires a hotfix to update the Restricted Groups behavior, Windows Vista and newer have this update built-in. This article describes the changes to the feature.
More Information
With the Restricted Groups Member of functionality, you can now add domain groups to local groups. For more information about the Restricted Groups feature, including Members and Memberof descriptions, see "Restricted Groups" in the Windows Server product documentation.
Windows XP
Service pack information
To resolve this problem, obtain the latest service pack for Windows XP. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
322389 How to obtain the latest Windows XP service pack
Hotfix information
A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix. Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=supportNote The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language. The English version of this feature has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. Date Time Version Size File name Platform ---------------------------------------------------------------- 31-Jan-2003 02:53 5.1.2600.1163 849,408 Scesrv.dll IA64 31-Jan-2003 02:53 5.1.2600.1163 307,712 Scesrv.dll i386
Adding Domain Groups to Local Groups
After you have verified that the feature is installed on all appropriate computers, you can use the Restricted Groups Member of setting to add a domain group to a local group (built-in or custom). You can define Member of policies for distinct groups in multiple Group Policy objects (GPOs) that are linked to any site, any domain, or any organizational unit (OU), and all the policies take effect. For example, as illustrated in the following table, you can create a policy that adds Domain Admins to the local Administrators group, and you can add a policy that adds My Management Admins group to the local Administrators group. This group is linked to a domain-level GPO. You can also create a policy that adds the My Organizational Unit Regional Admins group to the local Administrators group. This group is linked to an OU-level GPO. All policies are enforced.Table 1: Adding domain groups to local groups
|
Domain Group that you define a Restricted Groups policy for |
"Member of" entry: Local Group on member computers |
GPO level where the Restricted Groups policy is defined |
Result |
|---|---|---|---|
|
Domain Admins (domain built-in) |
Administrators (local built-in) |
Domain level |
Administrators group contains Domain Admins, My Management Admins, and My Organizational Unit Admins |
|
My Management Admins (domain custom) |
Administrators (local built-in) |
Domain level |
Administrators group contains Domain Admins, My Management Admins, and My Organizational Unit Admins |
|
My Organizational Unit Regional Admins (regional OU custom) |
Administrators (local built-in) |
OU level |
Administrators group contains Domain Admins, My Management Admins, and My Organizational Unit Admins |
Adding the same domain group to local groups across GPOs
If you create multiple Restricted Groups policies for the same group in multiple GPOs, only one policy will take effect. Restricted Groups policies for the same group do not merge across GPOs. The effective policy is determined by the order of the Group Policy processing. For information about Group Policy hierarchy and processing order, visit the following Microsoft Developer Network Web site:
http://msdn2.microsoft.com/en-us/library/aa374155.aspxFor example, as illustrated in the following table, two Restricted Group policies are defined for Domain Admins. One is defined at the domain level and adds Domain Admins to the local Administrators group. The other is defined at the OU level and adds the Domain Admins group to My Regional Division Admins. Domain Admins will only be added to My Regional Division Admins (by default, GPOs that are linked at the OU level override those that are defined at the domain level). Table 2: Adding the same domain group to local groups across GPOs
|
Domain Group for which you define a Restricted Groups policy |
"Member of" entry: Local Group on member computers |
GPO level where Restricted Groups policy is defined |
Result |
|---|---|---|---|
|
Domain Admins (domain built-in) |
Administrators (local built-in) |
Domain level |
Because of how GPOs are processed, Domain Admins will only be added to the My Regional Division Admins group. |
|
Domain Admins (domain built-in) |
My Regional Division Admins (local custom) |
OU |
Because of how GPOs are processed, Domain Admins will only be added to the My Regional Division Admins group. |
Domain controllers
In earlier versions of Windows, if a domain controller processes a Restricted Groups policy in which the Members section is left blank, all members are purged from the group when the policy is applied, regardless of the setting for Member of. For example, if you create a Restricted Groups policy at the domain level for Domain Admins with a blank Members section and if you included local Administrators in Member of, when the policy is applied, all members of the Domain Admins group are removed (including the built-in Administrator account), and an empty Domain Admins group is added to the local administrators group.The behavior in Windows 2000 SP4, Windows XP with Service Pack 2 (SP2), and Windows Server 2003 has been corrected. On a computer that is running one of these versions of Windows, if you apply a Restricted Groups policy that defines Member of but leaves Members blank, the Members section is ignored, and group membership is not emptied.If you plan to use the Restricted Groups functionality that is enabled by this update to configure domain controllers, member servers, or workstations, make sure that they are all running Windows 2000 SP4, Windows XP SP2, or Windows Server 2003 so that domain group membership is not modified unintentionally.For member servers and workstations, the behavior in this scenario remains unchanged.
Applying "Members" and "Member of" Restricted Groups policies to a local group
It is best to define a Restricted Groups policy that adds a domain group to a local group and to define another Restricted Groups policy that restricts that local group’s membership. The final group membership of that local group cannot be predicted because the processing order of the two Restricted Groups policies is not defined. For example, as illustrated in the following table, if you create a Restricted Groups policy that adds Domain Admins to the local Administrators group and if you create a Restricted Groups policy that limits membership of the local Administrators group to the built-in Administrator account, you cannot predict if either policy will be enforced. If Domain Admins are added to the local Administrators group before the Administrators membership is limited, Domain Admins will be added to the local Administrators group and then removed. However, if the local Administrators group membership is limited before Domain Admins is added to the Administrators group, Domain Admins will remain in the local Administrators group. Table 3: Adding a domain group to a local group with restricted membership
|
Group that you define a Restricted Groups policy for |
"Members" entry |
"Member of" entry |
Resulting group membership |
|---|---|---|---|
|
Domain Admins (domain built-in) |
None |
Administrators (local built-in) |
You cannot predict the final group membership for the local Administrators group. |
|
Administrators (local built-in) |
Administrator (local built-in) |
None |
You cannot predict the final group membership for the local Administrators group. |
To get the membership that you want, use either Members or Member of Restricted Group policies exclusively. In the example in Table 3, to get the Administrators group membership that you want, add Domain Admins to the Members entry for the local Administrators group Restricted Groups policy.
Windows 2000
Service pack information
To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
260910 How to obtain the latest Windows 2000 service pack
Hotfix information
A supported feature that modifies the default behavior of the product is available from Microsoft. However, this feature is intended to modify only the behavior that this article describes. Apply this feature only to systems that specifically require it. If the feature is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the feature. Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific feature. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=supportNote The "Hotfix download available" form displays the languages for which the feature is available. If you do not see your language, it is because the feature is not available for that language. The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. Date Time Version Size File name ------------------------------------------------------------- 07-Nov-2002 22:33 5.0.2195.6109 124,688 Adsldp.dll 07-Nov-2002 22:33 5.0.2195.5781 131,344 Adsldpc.dll 07-Nov-2002 22:33 5.0.2195.6109 62,736 Adsmsext.dll 07-Nov-2002 22:33 5.0.2195.6052 358,160 Advapi32.dll 07-Nov-2002 22:33 5.0.2195.6094 49,936 Browser.dll 07-Nov-2002 22:33 5.0.2195.6012 135,952 Dnsapi.dll 07-Nov-2002 22:33 5.0.2195.6076 96,016 Dnsrslvr.dll 15-Nov-2001 23:27 5,149 Empty.cat 07-Nov-2002 22:33 5.0.2195.5722 45,328 Eventlog.dll 07-Nov-2002 22:33 5.0.2195.6059 146,704 Kdcsvc.dll 01-Nov-2002 18:52 5.0.2195.6112 204,048 Kerberos.dll 21-Aug-2002 16:27 5.0.2195.6023 71,248 Ksecdd.sys 07-Nov-2002 02:02 5.0.2195.6118 507,664 Lsasrv.dll 07-Nov-2002 02:02 5.0.2195.6118 33,552 Lsass.exe 27-Aug-2002 22:53 5.0.2195.6034 108,816 Msv1_0.dll 07-Nov-2002 22:33 5.0.2195.5979 307,472 Netapi32.dll 07-Nov-2002 22:33 5.0.2195.6075 360,720 Netlogon.dll 07-Nov-2002 22:33 5.0.2195.6100 920,848 Ntdsa.dll 07-Nov-2002 22:33 5.0.2195.6100 389,392 Samsrv.dll 07-Nov-2002 22:33 5.0.2195.6120 130,320 Scecli.dll 07-Nov-2002 22:33 5.0.2195.6120 303,888 Scesrv.dll 07-Nov-2002 01:56 5.0.2195.6118 139,264 Sp3res.dll 07-Nov-2002 00:05 5.3.9.0 4,096 Spmsg.dll 07-Nov-2002 00:06 5.3.9.0 87,040 Spuninst.exe 07-Nov-2002 22:33 5.0.2195.5859 48,912 W32time.dll 04-Jun-2002 21:32 5.0.2195.5859 57,104 W32tm.exe 07-Nov-2002 22:33 5.0.2195.6100 126,224 Wldap32.dll 07-Nov-2002 02:02 5.0.2195.6118 507,664 Lsasrv.dll -- 56-bit For more information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the following article number to view the article in the Microsoft Knowledge Base:
265173 The Datacenter Program and Windows 2000 Datacenter Server product For more information about how to install multiple Windows updates or hotfixes while restarting only once, click the following article number to view the article in the Microsoft Knowledge Base:
296861 How to install multiple Windows updates or hotfixes with only one reboot
