This message was deleted.

Hmm…that’s interesting.

I’ve stopped using restricted groups in favor of preferences. My Microsoft guru colleagues (seriously cluey dudes) won’t use them - and I’ve had to unravel a few environments with narky RG behaviours

But how do you then manage stuff like CyberArk, which say you have to use RGs instead of GPP Local Users and Groups? (Or FSLogix, for that matter)

When applied to a DC, being the key, IMO.

I'm talking purely for managing local groups here, adding domain members to them

We use RGs for the local admin group, but not FSL.

I totally get they're not recommended for managing AD groups, and I think this is where this engineer has his knickers in a knot

"...What’s interesting about Restricted Groups policy applied to a DC, is that it does NOT log a 5136 event when the DC process that policy and adds a user or group to that local Group. Wait, what? That’s right, if someone manages to get a hold of one of these GPOs linked to a DC and injects arbitrary groups into the domain Administrators group, you won’t see a normal event log entry for it. In fact, you won’t see any event log entry for it..."

Yeah, just talking adding a domain group to the local "Remote Desktop Users" on Citrix servers here, no DCs in play. We've got an issue where the local groups don't populate because the RG GPOs fail. Microsoft's numpty engineers are trying to say this is happening because we're using RGs, but I think they're talking bollocks because they don't understand that we're not "managing" domain groups here, we're just adding domain groups to local groups on the member servers

Sometimes security people, like @Patrick Coble, can get their knickers in a wad and not see past one checkbox item. :)

I always use that for e.g. the AppSense acces account. BUT even though I document it exactly, the India folks always seam to be able to do it incorrect which then clears out all members and only adds that single one. Last few rollouts I did I simply used Group Policy Preferences which seams to do the job too

Security is Fun and with a million options from Microsoft it is never as simple as we want it to be for sure. Good luck on your journey.

I've always used Restricted Groups.. never had an issue.

That you are aware of :)

🙂 I was gonna add that .. ignorance is bliss

I’ll ask my Microsoft guru on the “why” from his experience - I’ve had issues with RG policies conflicting with preferences, Tiering and multi policies for different uses. Preferences don’t seem to have the problem. Why would cyberark mandate RGs, preferences achieve the same with way more flex and power - pretty sure (I’ll need to confirm) I’ve got customers with cyberark using preferences for local group memberships

I'm sure there's some work at one of my clients to remove GPP and use RG because of some issue with CyberArk. Might have it backwards, will confirm tomorrow

I try to never use or recommend RGs

I second the 'horseshit' comment, used them a lot, never had issues with domain principals being members of the managed local groups. Also this from MS website: Tip 2: To add new domain members to a local group using Group Policy Restricted Groups without removing the current members, you can proceed like the following: • Create a domain group and add the domain users / groups as member of it  • Use “Member of” feature to add the new domain group as member of the needed local group