Restricted Groups using local security policy

From: Nigel Benton (nigel_at_rbenton.screaming.net)
Date: 10/02/03 

Date: Thu, 2 Oct 2003 21:26:21 +0100

We're currently using restrctive groups within our 2000 Domain without

any problems. we do however have a number of standalone 2000 servers

(SP2/SP3) that are not part of a domain & sit in a workgroup.
We want to use restricted groups to lock down the administrators group on

these servers using local security policy. We've created and applied

restricted groups via security configuration & analysis on each server

but you are still able to change membership.Have also tried directly

importing templates containing restricted groups through the local

security policy but still no joy.
Is it possible to use restricted groups via local security policies on

stand-alone servers, and if so how. Most of the information I've managed

to find only seems to discuss implementation through group policies.

Thanks,

Nigel Benton.

Relevant Pages

  • Re: Cannot change Effective Security
    ... >For domain controllers you will have to use the Domain ... >> I have two AD domains with mostly Windows 2000 servers ... >> W2K servers, in either domain, using the Local Security ... >> never used domain policies, and just to make sure I went ...
    (microsoft.public.win2000.security)
  • Re: Local Security Policy question
    ... You can use the SECEDIT program (in a command shell) to export the local security configuration to a text file. ... conjunction with PSEXEC to centralize the audit of your 5 servers. ...
    (microsoft.public.scripting.vbscript)
  • Cannot change Effective Security
    ... never been able to change Local Security settings on the ... W2K servers, in either domain, using the Local Security ... Now before you tell me to check domain policies - I have ...
    (microsoft.public.win2000.security)
  • Group policy sometimes apply and sometimes not
    ... but i recently did a gpo that of SUS and another ... local security things to apply to my Servers OU, ... servers are receiving this and some not. ...
    (microsoft.public.win2000.active_directory)
  • Re: Disabling Local user accounts on member servers and workstations
    ... - Create an OU, move servers into it. ... and configure the restriction groups policy (Be careful ... Description of Group Policy Restricted Groups ... connecting to the servers I want to disable the account on. ...
    (microsoft.public.windows.server.active_directory)