Group Policy for local users/groups not working

[disturbedone]

I have a W2K8R2 domain and ~800 XPSP3 desktops. There are numerous GPOs, one of which uses the Computer Configuration/Policies/Windows Settings/Security Settings/Restricted Groups setting to add an AD group to the BUILTIN\Administrators local group. This works fine on XP but not W7.

After some Googling I found another way of doing it so I created a new GPO, put a W7 VM into a test OU and applied the GPO to it. This GPO uses the Computer Configuration/Preferences/Control Panel Settings/Local Users and Groups/Group[ (Name: Administrators (built-in))/Administrators (built-in)(Order:1)/Local Group setting to do the same thing (Googling about it tells me this is a better way of doing it than Restraicted Groups) but this fails to apply to my W7 computer.

Group Policy Results wizard tells me the GPO was successfully applied. But if I edit the properties of the local Administrators group on the W7 machine it doesn't list the group that I added with the GPO.

Is there something different about W7 and how this GPO works?

 

[disturbedone]

UPDATE: I added another entry to the GPO that would create a new local group with a single member and this part of the GPO worked.

The initial part to do with the local admin group was as follows:

[b]Action[/b]                         Update
[b]Properties[/b]
   Group Name                  Administrators (built-in)
   Rename to
   Description
   Delete all member users     Disabled
   Delete all member groups    Disabled
[b]Add Members[/b]
  DOMAIN\Domain Admins         S-1-5-21-4170326925-2383811997-614304044-8556
  DOMAIN\Support Staff         S-1-5-21-4170326925-2383811997-614304044-512

So it appears that it is a problem with the 'Update' action on the existing built-in local administrators group.

Further testing found if I add something to the 'Rename to' and 'Description' fields that it creates a new group and places the members in it.

If I change the action to 'Replace' it creates a new group called 'Administrators (built-in)' because the default group is just Administrators. I haven't yet tested to see if this actually works ie users in the group will have administrative rights. It just seems horribly confusing.

Anyone else tried to do this?