Article ID: 810076
Article Last Modified on 2/1/2007
APPLIES TO
- Microsoft Windows Server 2003, Standard Edition (32-bit x86)
- Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
- Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
- Microsoft Windows Server 2003, Web Edition
- Microsoft Windows XP Professional
- Microsoft Windows XP Home Edition
- Microsoft Windows XP Professional
- Microsoft Windows XP Home Edition
- Microsoft Windows 2000 Service Pack 4
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Datacenter Server
- Microsoft Windows 2000 Professional Edition
SUMMARY
In versions of Microsoft Windows earlier than Microsoft Windows 2000 Service Pack 4 (SP4), the Restricted Groups Member of security setting in Group Policy cannot be used to add domain groups to local groups on member computers. The Restricted Groups behavior was updated in Windows 2000 SP4 and in the Microsoft Windows Server 2003 family. Microsoft Windows XP Service Pack 1 (SP1) requires a hotfix to update the Restricted Groups behavior. This article describes the changes to the feature.
MORE INFORMATION
With the Restricted Groups Member of functionality, you can now add domain groups to local groups. For more information about the Restricted Groups feature, including Members and Member of descriptions, see "Restricted Groups" in the Windows Server product documentation.
Windows XP
Service pack information
To resolve this problem, obtain the latest service pack for Windows XP. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
322389 How to obtain the latest Windows XP service pack
Hotfix information
A supported feature that modifies the product's default behavior is now available from Microsoft, but it is only intended to modify the behavior that this article describes. Apply it only to systems that specifically require it. This feature may receive additional testing. Therefore, if the system is not severely affected by the lack of this feature, we recommend that you wait for the next Windows XP service pack that contains this feature.
To obtain this feature immediately, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:
The English version of this feature has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
Date Time Version Size File name Platform ---------------------------------------------------------------- 31-Jan-2003 02:53 5.1.2600.1163 849,408 Scesrv.dll IA64 31-Jan-2003 02:53 5.1.2600.1163 307,712 Scesrv.dll i386
Adding Domain Groups to Local Groups
After you have verified that the feature is installed on all appropriate computers, you can use the Restricted Groups Member of setting to add a domain group to a local group (built-in or custom). You can define Member of policies for distinct groups in multiple Group Policy objects (GPOs) that are linked to any site, any domain, or any organizational unit (OU), and all the policies take effect. For example, as illustrated in the following table, you can create a policy that adds Domain Admins to the local Administrators group, and you can add a policy that adds My Management Admins group to the local Administrators group. This group is linked to a domain-level GPO. You can also create a policy that adds the My Organizational Unit Regional Admins group to the local Administrators group. This group is linked to an OU-level GPO. All policies are enforced.
Table 1: Adding domain groups to local groups
| Domain Group that you define a Restricted Groups policy for | "Member of" entry: Local Group on member computers | GPO level where the Restricted Groups policy is defined | Result |
|---|---|---|---|
| Domain Admins (domain built-in) | Administrators (local built-in) | Domain level | Administrators group contains Domain Admins, My Management Admins, and My Organizational Unit Admins |
| My Management Admins (domain custom) | Administrators (local built-in) | Domain level | Administrators group contains Domain Admins, My Management Admins, and My Organizational Unit Admins |
| My Organizational Unit Regional Admins (regional OU custom) | Administrators (local built-in) | OU level | Administrators group contains Domain Admins, My Management Admins, and My Organizational Unit Admins |
Adding the same domain group to local groups across GPOs
If you create multiple Restricted Groups policies for the same group in multiple GPOs, only one policy will take effect. Restricted Groups policies for the same group do not merge across GPOs. The effective policy is determined by the order of the Group Policy processing. For information about Group Policy hierarchy and processing order, visit the following Microsoft Developer Network Web site:
For example, as illustrated in the following table, two Restricted Group policies are defined for Domain Admins. One is defined at the domain level and adds Domain Admins to the local Administrators group. The other is defined at the OU level and adds the Domain Admins group to My Regional Division Admins. Domain Admins will only be added to My Regional Division Admins (by default, GPOs that are linked at the OU level override those that are defined at the domain level).
Table 2: Adding the same domain group to local groups across GPOs
| Domain Group for which you define a Restricted Groups policy | "Member of" entry: Local Group on member computers | GPO level where Restricted Groups policy is defined | Result |
|---|---|---|---|
| Domain Admins (domain built-in) | Administrators (local built-in) | Domain level | Because of how GPOs are processed, Domain Admins will only be added to the My Regional Division Admins group. |
| Domain Admins (domain built-in) | My Regional Division Admins (local custom) | OU | Because of how GPOs are processed, Domain Admins will only be added to the My Regional Division Admins group. |
Domain controllers
In earlier versions of Windows, if a domain controller processes a Restricted Groups policy in which the Members section is left blank, all members are purged from the group when the policy is applied, regardless of the setting for Member of. For example, if you create a Restricted Groups policy at the domain level for Domain Admins with a blank Members section and if you included local Administrators in Member of, when the policy is applied, all members of the Domain Admins group are removed (including the built-in Administrator account), and an empty Domain Admins group is added to the local administrators group.
The behavior in Windows 2000 SP4, Windows XP with Service Pack 2 (SP2), and Windows Server 2003 has been corrected. On a computer that is running one of these versions of Windows, if you apply a Restricted Groups policy that defines Member of but leaves Members blank, the Members section is ignored, and group membership is not emptied.
If you plan to use the Restricted Groups functionality that is enabled by this update to configure domain controllers, member servers, or workstations, make sure that they are all running Windows 2000 SP4, Windows XP SP2, or Windows Server 2003 so that domain group membership is not modified unintentionally.
For member servers and workstations, the behavior in this scenario remains unchanged.
Applying "Members" and "Member of" Restricted Groups policies to a local group
It is best to define a Restricted Groups policy that adds a domain group to a local group and to define another Restricted Groups policy that restricts that local group’s membership. The final group membership of that local group cannot be predicted because the processing order of the two Restricted Groups policies is not defined. For example, as illustrated in the following table, if you create a Restricted Groups policy that adds Domain Admins to the local Administrators group and if you create a Restricted Groups policy that limits membership of the local Administrators group to the built-in Administrator account, you cannot predict if either policy will be enforced. If Domain Admins are added to the local Administrators group before the Administrators membership is limited, Domain Admins will be added to the local Administrators group and then removed. However, if the local Administrators group membership is limited before Domain Admins is added to the Administrators group, Domain Admins will remain in the local Administrators group.
Table 3: Adding a domain group to a local group with restricted membership
| Group that you define a Restricted Groups policy for | "Members" entry | "Member of" entry | Resulting group membership |
|---|---|---|---|
| Domain Admins (domain built-in) | None | Administrators (local built-in) | You cannot predict the final group membership for the local Administrators group. |
| Administrators (local built-in) | Administrator (local built-in) | None | You cannot predict the final group membership for the local Administrators group. |
To get the membership that you want, use either Members or Member of Restricted Group policies exclusively. In the example in Table 3, to get the Administrators group membership that you want, add Domain Admins to the Members entry for the local Administrators group Restricted Groups policy.
Windows 2000
Service pack information
To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
260910 How to obtain the latest Windows 2000 service pack
Hotfix information
A supported feature that modifies the product's default behavior is now available from Microsoft, but it is only intended to modify the behavior that this article describes. Apply it only to systems that specifically require it. This feature may receive additional testing. Therefore, if the system is not severely affected by the lack of this feature, we recommend that you wait for the next Windows 2000 service pack that contains this feature.
To obtain this feature immediately, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
Date Time Version Size File name ------------------------------------------------------------- 07-Nov-2002 22:33 5.0.2195.6109 124,688 Adsldp.dll 07-Nov-2002 22:33 5.0.2195.5781 131,344 Adsldpc.dll 07-Nov-2002 22:33 5.0.2195.6109 62,736 Adsmsext.dll 07-Nov-2002 22:33 5.0.2195.6052 358,160 Advapi32.dll 07-Nov-2002 22:33 5.0.2195.6094 49,936 Browser.dll 07-Nov-2002 22:33 5.0.2195.6012 135,952 Dnsapi.dll 07-Nov-2002 22:33 5.0.2195.6076 96,016 Dnsrslvr.dll 15-Nov-2001 23:27 5,149 Empty.cat 07-Nov-2002 22:33 5.0.2195.5722 45,328 Eventlog.dll 07-Nov-2002 22:33 5.0.2195.6059 146,704 Kdcsvc.dll 01-Nov-2002 18:52 5.0.2195.6112 204,048 Kerberos.dll 21-Aug-2002 16:27 5.0.2195.6023 71,248 Ksecdd.sys 07-Nov-2002 02:02 5.0.2195.6118 507,664 Lsasrv.dll 07-Nov-2002 02:02 5.0.2195.6118 33,552 Lsass.exe 27-Aug-2002 22:53 5.0.2195.6034 108,816 Msv1_0.dll 07-Nov-2002 22:33 5.0.2195.5979 307,472 Netapi32.dll 07-Nov-2002 22:33 5.0.2195.6075 360,720 Netlogon.dll 07-Nov-2002 22:33 5.0.2195.6100 920,848 Ntdsa.dll 07-Nov-2002 22:33 5.0.2195.6100 389,392 Samsrv.dll 07-Nov-2002 22:33 5.0.2195.6120 130,320 Scecli.dll 07-Nov-2002 22:33 5.0.2195.6120 303,888 Scesrv.dll 07-Nov-2002 01:56 5.0.2195.6118 139,264 Sp3res.dll 07-Nov-2002 00:05 5.3.9.0 4,096 Spmsg.dll 07-Nov-2002 00:06 5.3.9.0 87,040 Spuninst.exe 07-Nov-2002 22:33 5.0.2195.5859 48,912 W32time.dll 04-Jun-2002 21:32 5.0.2195.5859 57,104 W32tm.exe 07-Nov-2002 22:33 5.0.2195.6100 126,224 Wldap32.dll 07-Nov-2002 02:02 5.0.2195.6118 507,664 Lsasrv.dll -- 56-bit
For more information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the following article number to view the article in the Microsoft Knowledge Base:
265173 The Datacenter Program and Windows 2000 Datacenter Server product
For more information about how to install multiple Windows updates or hotfixes while restarting only once, click the following article number to view the article in the Microsoft Knowledge Base:
296861 How to install multiple Windows updates or hotfixes with only one reboot
Keywords: kbfix kbwin2000presp4fix kbqfe kbsecurity kbwinxpsp2fix kbwin2ksp4fix kbhotfixserver KB810076
