Sign in
 

none
Adding users to administrator group not working with preferences

 > 

    Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    I have an OU called 'Test', one computer is in this OU.

    In the 'Test' GPO I am using Group policy preferences, computer configuration,  I have set action 'Update' to group name 'Administrators (built-in)'. Added the group %DomainName%\Test to this group. Delete all member users and groups unchecked. I linked the GPO to the 'Test' OU. I ran gpupdate /force on the computer and rebooted. Checked the administrators group and it did not get the group added.

    Any idea's?

    -AR

    Tuesday, September 29, 2015 7:11 PM
    |

Answers

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote
    check gpresult and also local computer event logs for correct GP processing

    Don

    Tuesday, September 29, 2015 9:29 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    From your post it's not clear whether you also created a "Test" group in AD (it's to this group you add the users).

    Rolf Lidvall, Swedish Radio (Ltd)




    • Edited by Rolf Lidvall Wednesday, September 30, 2015 6:53 AM
    Wednesday, September 30, 2015 6:50 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    Do you have another policy that is still applied and uses "Restricted
    Groups"? This will override your change :)
     
    Greetings/Grüße, Martin

    Mal ein gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me - coke bottle design refreshment (-:
    Wednesday, September 30, 2015 3:27 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Okay, more information. I originally had the test OU buried among other OU's and there were a bunch of other GPO's involved also. So I moved the test OU to the root of the forest to eliminate all the other GPO's from affecting this OU. Still the same thing. Event log shows 4 GPO applied successfully which I expect. I do not have Restricted Groups set at all. In fact if I manually put in the Groups I want and do gpupdate they get wiped out. And there is a set of minimal GPO's (like I said-4) affecting this OU.

    Still researching. And from what I see RSOP doesn't give you the prefernce items?

    -AR

    Wednesday, September 30, 2015 8:10 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    ...from what I see RSOP doesn't give you the preference items?

    use gpresult /h filename.html - don't use RSoP (RSoP is old and doesn't show everything)

    Don

    Wednesday, September 30, 2015 8:56 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    ...from what I see RSOP doesn't give you the preference items?

    use gpresult /h filename.html - don't use RSoP (RSoP is old and doesn't show everything)

    Don

    Okay, got ya. Under the gpresult output under Group Policy Objects\Applied GPOs is that the order from top to bottom that the GPOs were applied?

    Thank you!

    Thursday, October 01, 2015 9:25 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Under the gpresult output under Group Policy Objects\Applied GPOs is that the order from top to bottom that the GPOs were applied?

    Yep.

    http://blogs.msdn.com/b/muaddib/archive/2012/08/22/determine-gpo-precedence-with-gpmc-gpresult.aspx

    https://blog.thesysadmins.co.uk/group-policy-gpresult-examples.html

    You can also use gpresult /v, or gpresult /z, depending upon how deep you need to dig down into it

    Don

    Thursday, October 01, 2015 10:42 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    > Okay, got ya. Under the gpresult output under Group Policy
    > Objects\Applied GPOs is that the order from top to bottom that the GPOs
    > were applied?
     
    Up to Win7: Yes.
     
    Starting with Win8: Unfortunately no - they decided to sort
    alphabetically. If you want to enumerate the order of processing in Win8
    and above, you have 2 choices:
     
    a) create the report remotely from a Win7 computer
    b) check the group policy eventlog for Event ID 5312 ("List of
    applicable Group Policy objects")
     
    Greetings/Grüße, Martin

    Mal ein gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me - coke bottle design refreshment (-:
    Friday, October 02, 2015 10:31 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    Hi,
     
    I'm just writing to check how's everything going? If you have any questions or needed further help on this issue, please feel free to post back.
     

    Regards,

    Ethan Hua

    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Wednesday, October 07, 2015 10:24 AM
    |
    Moderator