Restricted Groups

[windowsfan]

I have confiugred Restricted Group in AD. It logs event ID 1202. How can I take care of this? I tried restricted group for domain admins and ent admin but did not work.

I tried
1. Identify accounts that could not be resolved to a SID:

From the command prompt, type: FIND /I “Cannot find” %SYSTEMROOT%\Security\Logs\winlogon.log
and it displays domain admin and ent admin account.

 

[58sniper]

I've had better luck browsing for the groups and not typing in the names. YMMV

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[windowsfan]

Thats what I did.

 

[Rockstar101]

I would start over because setting up a gpo with restricted groups should be pretty straight forward and the KEY is to Browse to the names otherwise it doesn't work well.

 

[windowsfan]

I tried multiple times but I get the below error. This error logs are from c:\windows\security\logs\winlogon.log
----Configure Group Membership...
Configure Enterprise Admins.
add CN=Role_GL_EnterpriseAdmin,OU=Admins,DC=zhc,DC=com.
Error 1003: Cannot complete this function.
error adding object to CN=Enterprise Admins,CN=Users,DC=zhc,DC=com.
Error 1003: Cannot complete this function.
One or more new members failed to be added so some existing members are not removed.
Configure Domain Admins.
add CN=Role_GL_DomainAdmins,OU=Admins,DC=zhc,DC=com.
Error 1003: Cannot complete this function.
error adding object to CN=Domain Admins,CN=Users,DC=zhc,DC=com.
Error 1003: Cannot complete this function.
One or more new members failed to be added so some existing members are not removed.
Configure ZHC\Enterprise Admins.
Configure ZHC\Domain Admins.
Group Membership configuration was completed successfully.