Restricted Group Usage in GPO's

[SirLee]

I am trying to do achieve a very simple thing (or so I thought...) I want all my Domain Users to be LOCAL administrators on the client machines.

I created an OU and added all the computers into it.
For that OU I created a Group Policy where I modified the Restricted Groups. They look like this now:

Group Name Members Member Of
Administrators MYDOMAIN\Domain Users

My Problem is that after rebooting the Client PCs (Win2K) to inherit the Policy the Domain users still do not have administrative right on their local machine. How are those restricted groups supposed to work?

Thank you

 

[CAlliey]

This is kind of an old thread - but I'll reply anyway, since nobody else did.

The restricted group you setup says that all domain users are administrators of *all* the machines in the OU it is applied to.