[ActiveDir] Help with Restricted Groups

[Creamer, Mark]

I had posted some questions a week or so ago, which Guido and some others kindly responded to. It’s still not quite doing what I thought it would do, so if you’ll bear with me, I’d like to outline my steps and see what’s wrong.   Three Windows 2000 domains, a root and two subs. A Universal group UnivAdmins has been created in the root domain. It contains members whose accounts exist in the 2 subdomains.   In each of the 2 subs, I created a Servers OU, and placed some test Win2K SP4 servers in the OU. Then I set up a GPO applied to that OU. Under Computer Configuration/Windows Settings/Security Settings/Restricted Groups, I did Add Group, and added my UnivAdmins Group. Then I right-clicked and did Security.   Here’s where the confusion comes in: I tried adding “Administrators” to the “This group is a member of” dialog, with the intention that this would make the Universal group a member of the local Administrators on each server inside the OU that this GPO applies to. I have waited for replication, applied secedit /refreshpolicy, tried rebooting the member server, etc. but the universal group never shows up in the Administrators group of the local server. Can someone help me out with this?   Thanks!   Mark Creamer Systems Engineer Cintas Corporation Honesty and Integrity in Everything We Do