Okay.
Now I want a demo of this restricted groups or group membership control scenario using restricted groups
policy.
So I'm on my Windows seven desktop machine that's a member of the marketing.
Oh, you.
And I'm looking at the local groups on this Windows seven machine, and I've got this remote desktop
users group.
And I mentioned it earlier as the group that grants remote desktop access to the system, and you'll
see that it has no members in it.
So then what I'm going to do is come over to my domain and I'm going to go ahead and create and link
a new GPO in the domain.
I'm going to call it the restricted group's policy.
And now that I have this linked and defined on the domain, I'm going to go ahead and edit it and I'm
going to drill in under computer configuration.
Windows settings.
Security settings.
And you'll see here I've got restricted groups as a policy area.
I'm going to add a group.
Now I've got a group called Help Desk Admins that I'm going to use as my policy target.
So if I click on check names, it'll return helpdesk admins.
That's a global group.
I created an Active Directory.
And then what you'll see here is that when it comes up, I've got two options.
I can either use members of this group, which is the absolute control portion of restricted groups
policy or I can use this group is a member of which lets me add the target group in this case helpdesk
admins to other groups.
And that's what I want to use.
I don't want the absolute control part.
I want the discretionary edition of groups part.
And what I'm going to do here is.
I'm going to say.
Add it to remote desktop.
I'll search on that name.
Add it to remote desktop users.
Now this group, meaning helpdesk admins, will be made a member of remote desktop users on all the
computers that process this policy.
All right, so now I've got my member of four restricted group set.
Let's come back to my client.
We'll go ahead and fire up.
Update.
Let's open a command.
Prompt update slash targeted computer because I'm interested in computer policy.
And policy getting applied to this workstation.
Now let's go in under remote desktop users and see what happens.
There we go.
There's my helpdesk admins group that's now been added to this remote desktop users group.
So a quick and easy way to use restricted groups policy to control local group membership.
And again, if I were not an admin on this workstation, I couldn't go in and change this group membership
at all.
So essentially I'm enforcing this policy over my machines configuration.