GPO to enforce Restricted Group Access

[jmesidor]

I want to create a GPO to enforce group access. In my environment, some users are allowed to be Local Admins on their machines so they can install software. Because my domain has been migrated to an Enterprise level where I can only manage my Department OU; when I add a machine to the domain, my dept. OU admins don't get added to the Local Admins group on the box. I use a Restricted group GPO to enforce the inclusion, but it removes everyone that was already a member except for administrator.

Does anyone know how to prevent that from happening?

[jmorgan]

I found out by the same process that is what restricted group does, it replaces the contents with what you specif... was not suitable for me for the same reasons, local user needed admin rights... so i just used the manage function in Active Directory Users and Computers proggie to insert my userid into their admin location.

Hope this helps... i am still looking at other alternatives.

[jmorgan]

I found out by the same process that is what restricted group does, it replaces the contents with what you specif... was not suitable for me for the same reasons, local user needed admin rights... so i just used the manage function in Active Directory Users and Computers proggie to insert my userid into their admin location.

Hope this helps... i am still looking at other alternatives.