MCITP 70-640: Local Group Management with Preferences

Management of local groups on your clients can be achieved using Group Policy as well as Group Policy Preferences. This video looks at how Group Policy Preferences can be used to manage local groups on your clients and how to combine them with Group Policy Restricted Groups.

User/Group Management
Using preferences you can perform a number of actions on a local group.
Create: Will create the user\group if it does not exist. If the user\group does exist it will not be modified.
Replace: This will delete the user\group and recreates it. In the process of doing this the user\group will obtain a new Sid.
Update: Will update the user\group as required. If the user\group does not exist it will be created.
Delete: Will remove the user\group.

Combing the two
If you use restricted groups and Group Policy Preferences together, restricted groups will override Group Policy Preferences.

Demonstration
The settings for modifying local users and groups are found in the following location.
Computer Configuration\Preferences\Control Panel Settings\Local Users and Groups
To create the settings for a user or group, click the blank area on the right and select new user and local group.
In the dialog to follow, you need to enter in the user and group that you want to target. There is also an option to rename the user or group if you require.
There are additional options on the common tab. One useful option when changing group membership is, "apply once and do not reapply". This will ensure that this setting is only ever applied once. When fixing problems with local groups, this is a useful option to use as it will allow another administrator to make changes later to the local groups without those changes being reversed back on the next group policy refresh.
There is also an option for item-level targeting. This will allow you to target the settings to certain computers or users like which groups they are in, how much memory is install in the computer only to mention a few of the options that are available.

References
"MCTS 70-640 Configuring Windows Server 2008 Active Directory Second Edition" pg. 323 -- 324

[itfreetraining]

No problem at all, thanks for watching.

[itfreetraining]

There are part of the 70-643 course. They are old videos so you can only access them via the web page due to quality not being as good as the newer videos.

[inv]

Great Explanation and good quality of sound & video. Excellent Presentation skills. I have so many training videos, but I prefer ITfreetraining videos, these are very use ful and easy to understand. Thanks again for ITfreetraining, , Thanks a lot !!!!

[itfreetraining]

I would tend yo use restricted groups when I want to make sure the changes is being applied. For example, adding the help desktop administrators group to all the local administrators groups on the computer. You can get the same result with preferences, however I would use preferences when I want a few more additional options however I am not to worried if a few computer to do not get configured correctly.

[itfreetraining]

Glad to hear that you like the video. Could you give me the time code of the video you are not understanding. I am have difficult finding the part of the video that your are referring to.

[Jitutechstuff]

Dear ITFree Training Team, Your videos are more help full. I kindly Request can you please up load CLUSTERING AND NLB VIDEOS PLZ.

[OMERMAHGOUB]

I watched all your Videos. I just wanted to say thanks. It helped me a lot :)
Thanks

[gadgetproblemnoproblem]

Thanks a lot again for your Amazing and Precise videos.

[terry]

i love your video so much, but one sentence confuses me...
"how much memory is install in the computer only to mention a few of the options that are available."
what does the sentence mean? I am not native speaker...

[teknet]

how do you set this with local user and not domain, do you use .\username ?

[zoltron]

Thanks for the videos. My 70410 book by Don Poulten talks about this but it doesn't have a live example.... sometimes you just need to look at an example to understand...

I have a question I want to setup a hyper v lab on my 2012 machine and setup ad, dhcp and dns but I don't want my dhcp server to assign ip's to my other machines attached to my cable modem. If i set it up as a private network in hyper v, will it affect my other computers?

[staj]

Thanks a lot again for your Amazing and Precise videos.

I just wanted to verify what scenarios you'd advise one to choose between using "Restricted Groups" and "GP Preferences".

From your teachings. so far i know that GP preferences is more flexible (create, replace update options) and granular (adding groups at the User level etc.)