Filter Group Policy settings through delegation

mission requirements

A domain group named IT has been created in the "WorldSkills2017.china" domain. It is required to set the IT group as the local administrator of all machines in the domain except the domain controller.

Mission Analysis and Implementation

To accomplish this task, it is important to set delegation for Group Policy.

Start by creating a group policy called Set IT Group as Local Administrator and opening Computer Configuration/Preferences/Control Panel Settings/Local Users and Groups.

Right-click Local Users and Groups, select New/Local Group, select Administrators group, and add IT group as a member.

When setup is complete, close the Group Policy Editor, check the Make IT Group Local Administrator Group Policy, turn on delegation, and click the Advanced button to

Then add the Domain Controllers group and set the Apply Group Policy permission to Deny.

At this point, the group policy configuration is complete.

Verification on the client side

Because the settings are made in "Computer Configuration," it is necessary to restart the client computer. After restarting, open "Local Users and Groups" and you can see that the IT group has been successfully added to the Administrators group.