Could someone please explain Restricted Groups?

woodworm

My understanding is that you can specify which users are a member of a particular local group.

e.g.
User Group
Lee Administrators
Sarah Administrators

If Lee then added Steve into the Administrators Group the Group Policy would remove Steve on the next refresh?

Is this correct or do I have the wrond idea all together? And is Group Policy the correct way of setting this?

Thanks for all your help in advance.

keef-richards

I think your getting yourself muddled up here m8

Local policy ONLY affects users on THAT particular machine.
The administrator group allows other administrators to have total control of the local machine and allows them to add other users to the Administrator group.

So to answer your question if Lee and sarah are Administartors and Lee adds steve as an administrator as well, then all THREE of them will be local administrators.

In a domain environment Group Policy means that even if you were a local administrator, all this does is let you have exclusive administrator rights for THAT particular machine. The domain user group would dictate what privledges you had on the network.