Management group membership can be a time consuming task especially if you must modify the membership
of groups on workstations or servers distributed throughout the enterprise.
For example you might need to add a user or global group to the local administrators group on client
computers or add a global group to the backup operation.
Groups on servers.
Group policy provides a Saddam called restricted groups that enables you to control the membership of
local groups on domain and computers.
This system also enables you to control the membership of ADT as groups by configuring a GPO and to
sign in the GPO to the O you hold in those computer accounts.
You can find the restricted group set in their computer configuration policy under Windows sentence
and then under security settings it contains no groups by default.
Please know that to configure membership in ADT as groups you must decide the GPO to the O you that
holds the domain controllers computer accounts.
You can also configure group nest and by using their restricted group setting.
For example you could use restricted groups to nest global groups sent to universal groups.
All the rules governing group nest and still apply when using restricted groups.
Please know that the restricted group setting is only available in domain level group policies.
It does not exist in local group policies on Windows client and so or operating systems.
Now some words about removal of non designated members one of the benefits of restricted groups is that
it will also remove any user or group from the targeted group.
If they are not on the list of users or groups there is a set and a.
This is useful if control and the membership of high level administrative groups such as enterprise
segments domain admin sound local administrators group on Soros and clan computers.
If you manually add users to a control group the restricted group certain will remove them the next
time group policy refreshes.
The only exception to this rule is the local default administrator account can never be removed from
their local administrators group.
If the policy object that you use to configure the restricted group membership is unlinked from the
container holding the computer accounts or if you delete the restricted group entry from the GPO then
the group memberships that it is signed are not removed.
You must modify those group memberships manually.