Automatically lose group membership to local group on server 1

[dprello]

Hi.

We have a mixed mode AD. DCs are 2003. I have a server which I have given a Global Security Group membership of the local administrators group on a member server in the AD domain.

On a daily basis, that group gets removed from the local administrators group on the server, and each time I have to put them in again.

I've done auditing, but either I'm auditing too much, or not looking in the right area. I know nobody else is removing them manually.

Can someone please shed some light? Is this a local security policy? Is it a Group Policy setting? Any help you can offer me is appreciated. Where should I start looking?

Thanks,

DPRello

 

[porkchopexpress]

It sounds like restricted groups is in use somewhere in your active directory maybe from an admin with control over the OU above, or someone has set this up in the past.

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

 

[dprello]

Aha! You are absolutely right! There was a second Group Policy applied to the AD servers last month which I was not made aware of.

Thanks for the help Porkchopexress!

DPRello