Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to mandate the members of the Local Administrator group in the domain. Group Policy would add members if they are missing, and remove them if they shouldn't be there, as judged by this list. Is this possible?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

This is indeed possible. :)

Possibilities include "Restricted Groups":

This feature enables you - as the administrator - to configure group memberships on the client computers or member servers. You can add user accounts to groups on client machines that are in the scope of the policy

Or perhaps, the "Local Group" Group Policy Preferences:

The initial task of securing the local Administrators group is to ensure that the user no longer has membership in the group. This is easier said than done, since most companies have configured the user’s domain account to have membership in this group at installation of the user’s computer.

...As a perfect solution, you can use the Local Group – Group Policy Preference to accomplish the task within about 90 minutes of you implementing it.

share|improve this answer
    
We use Restricted Groups for exactly this (OP) purpose. –  Patrick S. Aug 10 '11 at 23:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.