Restricted Groups Policy Settings

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Restricted Groups

This security setting allows an administrator to define two properties for security-sensitive groups (or restricted groups). The two properties are Members and Member Of.

The Members list defines exactly who belongs and who does not belong to the restricted group. Both inclusion on the list and exclusion from the list, are enforced.

The Member Of list specifies groups in which the restricted group is included. Only inclusion in the Member Of list is enforced, not exclusion: If you remove a group from the Member Of list, the restricted group is allowed to remain a member of the removed group.

Note

• Misuse of this policy setting is a common error that can cause data loss or problems with data access or security.

Location

GPO_name\Computer Configuration\Windows Settings\Security Settings\Restricted Groups\

Default Values

Server Type or GPO	Default Value
Default Domain Policy	Not defined
Default Domain Controller Policy	Not defined
Stand-Alone Server Default Settings	Not defined
DC Effective Default Settings	Not defined
Member Server Effective Default Settings	Not defined

Discussion

The Restricted Groups folder is available only in Group Policy objects associated with domains, organizational units, and sites. The Restricted Groups folder does not appear in the local Group Policy object.

If a restricted group is defined so that it has no members (that is, the Members list is empty), all members of the group are removed when the policy is enforced on the computer. If the Member Of list is empty, no changes are made to any groups to which the restricted group belongs.