Configuring Restricted Groups Using Group Policies | Windows Server 2019

[@MrStrife622]

Exactly what I needed, tyvm!

[@williesolomon614]

Thank you for your clear and impressive explainations. Thank you also for sharing this important video tutorial. God bless.

[@MSFTWebCast]

So nice of you.

[@MajesticBlueFalcon]

Easy to follow along! Good work!

[@FranzGuerrero]

Hello. Great video very detailed, clearly explained for users that are trying to jump into leaning how to apply GPO to local groups. Using this same concept. Is there a method to assign this local admin roll to the local admin group temporarily,, so the system self remove the local admin access after some pre-define days?

[@onenotes9721]

Another day - another great video sir! I would like to request a video on how to setup a VPN Server A step by step guide for dummies on how to configure VPN Server using Microsoft's VPN Server (which should be free) I think you have a video configuring VPN and Direct Access but some important steps are missing and I cannot figure out how to make it work Also I think you should include a donation link because you have put a great effort on these videos and even sorting them out. Exceptional! Thank you very much

[@kamaljeetsingh3778]

Excellent Sir !!!

[@babukarthick7616]

Nice documentary

[@AzaamBasheer]

Thank you for your clear explanation. There are a couple of drawbacks in terms of adding normal users to the group coz all users in the group will have admin access to all the computers in the network, but configuring this for administrative management is helpful in terms of support. Also, if the normal users are added likewise; they can add any domain users they want to the local built-in Administrators group. Any advise to prevent admin users adding other domain users to the built-in Administrators group? I think it will be much helpful if you do a video when you get a chance. 🙂 Thanks again!

[@shabeelaboobacker352]

MS Laps is the solution.

[@josemisiego]

this guide was awesome thank you

[@MSFTWebCast]

Glad it helped!

[@LoveDaisy2024]

Thank you

[@DevendraSrikakulam]

Hi thanks for the explanation for the task..and we need to give admin privileges to the temp and prefetch folder for the domain user. Is it possible? can you please help me?

[@arvind7961]

If you giving the user administrator right for disk management permission. In administrator right having user can use optional features. So he can install active directory too. So he can acces the ad after the installation. So now he can access the ad so he can change anything even he can access the server by giving rols. Is there any either options like giving permission only of disk management.

[@joepeeer4830]

❤❤❤

[@rohitvaid2511]

Hi, need urgent assistance on something. Is it possible to remove the domain administrator user account from built-in administrators group on the domain controller.

[@VeryEasyCookingmymana]

😀😀😀😀thanks

[@ahmedsaad-lk2og]

thanks

[@devd5744]

what should be in security filters, Authenticated users or the group we added in restriction group????

[@MSFTWebCast]

Depends on what you want to achieve. Authenticated Users (is a system group) means all users who have logged in with a username and password. So this will includes all the users from the domain. Group will limit the access to group members only.

[@mahmoudbahnasi5680]

What diff between administrators and power user

[@MSFTWebCast]

Refer this article for more detailed information: 4myreference.wordpress.com/2012/12/04/difference-between-administrator-and-power-users/

[@udhaykumar3257]

If the users from tech support group, logon to different client machine will they have same admin privilege to perform administrative operations

[@michaelallwin9356]

Those computers should be under the Same OU as per the example where the GPO is linked..

[@Sivim]

Nice job

[@avinashkakde5227]

I am worried the Administrator Group selected at the time of GPO configuration was of Domain Administrator or Workstation Administrator. Confusing.

[@MSFTWebCast]

It is built-in Administrators group. That will look for local built-in administrators group on local system where policy is applying. So basically is is workstation administrator group in this case.

[@mayankpurushottam2150]

ADDS GPO policy to Block Copy & delete for OU user

[@tonyfernandes216]

hi I'm doing lab work can you please help with this, I'm using win10 pro as client and server2019 both on VM"IT users need local admin privileges in their computer to test their inhouse developed application and troubleshoot"

[@MSFTWebCast]

You need to add IT Users group into built-in Administrators group on Windows 10 using Restricted Group Policy. At time 6:06 you need to select "This is group is a member of" option and choose Administrators group. Link the GPO to the OU where you have saved the computer account of your Windows 10 VM.

[@tonyfernandes216]

@@MSFTWebCast you are absolutely a geniuses and a life saver. thanks a lots

[@TaystTheNotes]

So for user being in the domain administrator’s group it doesn’t give him access to all the other computers in the domain? I would’ve thought you would’ve chosen a local administrators group not a domain-based one (see the description: unrestricted access to the computers and domain). I do see where you linked the OU but still question the security of this particular move.