Welcome to IT Free Training’s video on modifying local groups using Group Policy Preferences.
If you watched our last video on Group Policy Restricted Groups, you would have learnt how
to use Restricted Groups to control local group membership for clients in your company.
The same results can be achieved using preferences. This video will show you how to use preferences
effectively to configure local groups. Group Policy Preferences can also be used to fix
previously made mistakes in local group creation. Group Policy Preferences offers a lot of control
and flexibility for local user and group management. For starters, you can create a local user
or group. Once the user or group is created on the local computer it is retained even
if the Group Policy is no long being applied to that computer. The Group Policy may no
longer be applied if the user or computer account has been moved or if the Group Policy
has simply been removed or disabled. Group Policy Preferences has a Replace option
which is used to recreate a user or a group. A word of warning with this option though,
this will essentially delete the user or group before recreating it. Since the user or group
is being deleted and recreated, this will mean the SID will change. If you used that
user or group, for say file permissions, once the user or group has been deleted, its permissions
will no longer be valid. If you need to create or change the membership
of a group you are better off using the update option. When using the update option, if the
user or group does not exist Group Policy Preferences will create it. If on the other
hand it does exist, Group Policy Preferences will simply update the membership. This means
that the SID used will be retained. As you can see with our demonstration, when updating
a group you can remove all users and group memberships, essentially allowing you to start
again. The last option – Delete allows you to delete
a user or group from the local computer. This is a useful option if you want to perform
a cleanup on the clients in your domain. In the last video I looked at Restricted Groups
which can be used to achieve the same result as Group Policy Preferences. If you decide
to use Restricted Groups and Group Policy Preferences together, the point to remember
is that if a local group is being controlled by Restricted Groups, Group Policy Preferences
will not be able to modify the group. This means you will only be able to use one system.
If you attempt to use the two, Group Policy Preference options will be ignored.
I will now change to my Windows 7 computer to look at how to configure Group Policy Preferences
to Manage local groups. First I will open the Local User Manager from
the Start menu. If I look at the local groups on this computer, you can see a group has
been created called Audit Software. This was created on each local computer to allow the
company audit software to run. The problem with this group is that if I open it you will
notice that the domain admins group has been added to this group. In order to get the company
audit software to run in a hurry, a decision was made to add the Domain Admins group to
this local group. This gives the audit software more access than is required and is poor practice.
This is a good example of a situation that happens way too often in IT. In order to get
a job completed on time some poor decisions get made in haste. Group Policy Preferences
can be used to fix poor implementations such as these.
To do this, I will open Group Policy Management from the Start Menu. To make the change, I
will edit the New York Policy found under the New York OU. To add a local user or group,
I will open Computer Configuration, Preferences, and Control Panel Settings and then open Local
Users and Groups. In here you can add Local Users and Groups at the computer level.
By using Group Policy Preferences, notice that if I expand down into User Configuration
the same options for local users and groups are available. This is one of the advantages
of using Group Policy preferences compared with using Group Policy Restricted Groups.
Restricted Groups can only be at the computer level.
To create a new group, right click the blank area and select the option new Local Group.
At the top you can choose the action for the group. It is important to select the right
option here. Create will create the group if it does not already exist. Replace will
effectively delete the group if it exists, then create a new group. Update will create
the group if it does not exist or use an existing group if it does exists. The delete option will
remove the group if it exists. In this case I will use the update option
as I want to make some changes to the group rather than delete or create a new group.
This will ensure that the SID for the group does not change.
The next step is the group name needs to be entered. A useful feature with the update
option is that you can also change the name of a group. In this case I will change the
group name to Audit Software Ver 2.Next I will enter in a description for the group.
Since I am using the user configuration section of preferences rather than computer configuration,
there are some additional options for the current user. In this case I will add the
current user to the group. Current user refers to the user that is logged into the computer
when the Group Policy is applied. These three radio buttons for the user are not available
in the computer side of preferences. In this case, since I am effectively cleaning
up a mistake made before, I will select both the options on the right, “Delete all member
users” and “Delete all member groups.” This will ensure that the local group is empty
before I add any more members to it. At the bottom I can add which users and groups
I would like this group to have. In this case I will add a user account I created called
DomainAuditService. This user account will be used with the audit software rather than
the Domain Admins group. Once added, I will next select the Common
Tab. Notice that I can tick the option, Item-Level Targeting. Once I press the targeting button
notice all the different options I now have for targeting. All these can be used to decide
which criteria’s is being used for creating or modifying a group. For example, you could
create a group if certain software was created on the computer.
Another option to use when undergoing cleanups is to use the option “Apply once and do
not reapply”. This will ensure that once the setting for this Group Policy has been
applied it will not be applied again later on. Normally a Group Policy setting will be
reapply when the Group Policy is refreshed, configuring this option will ensure that once
the policy has been applied it will not be applied a second time.
In this case, this is a good option to have on. This will allow the Group Policy to make
changes to the existing local group. Once the changes have been made, additional changes
can be made by software or the administrator without fear of these changes being erased
later on when Group Policy is refreshed. Now that I have configured the settings, I
will now exit out of Group Policy Management and then log off. Once I have logged off,
I will log back in again. This will allow group policy for the user to be reapplied.
You could also run GPUpdate to apply the changes, however since I have added the current user
to a local group, the user’s token needs to be recreated to include membership of this
group. For this reason a log off is required. To check that changes were made successfully,
I will now open the Local User Manager from the Start Menu. If I go back into Groups,
notice that the Audit Software group has changed its name to Audit Software Ver 2.
If I open the properties for this group, notice that the two users DomainAuditService and
Trainer have been added. The user account that I am currently logged in with is Trainer.
You can see how powerful Group Policy preferences can be for local group membership.
Thanks for watching this video from IT free Training, just one of the free videos available
for the Group Policy course - part of the Active Directory course.
Thanks for watching and see you in the next video.