Windows Forum

Ask something
Discussion Locked

Domain-local group member removal

0 helpful
4 replies

by tolkienring

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am using a domain local group (Call it "Deny")to phase in the group-policy controlled roll out of Win2k SP3.

Members of the group have Deny permissions to the policy. When I remove them, the policy should be applied, and the service pack should install. This has worked in the past.

However, the install is not occurring. GPRESULT.exe run on the workstation shows that it still believes itself to be a member of the Deny group.

I have verified that the machine accounts have been removed from the Deny group on both DC's, and have rebooted DC's and workstations multiple times.

Question: Why does the workstation still think it is in this group...where is it pulling this membership information from? How can I kick it out?

4 replies

by bigwon20

YOU SHOULD GO INTO MY COMPUTER AND LOOK AT YOUR COMPUTER NAME FROM THERE YOU CAN RENAME THE MACHINE.... IT SHOULD THEN ACKNOWLEDGE THAT IT IS

by tolkienring

No, I don't think that renaming 400 workstations is viable option.

Turns out I accidentally nested another domain local group - which contained all of my workstations - when I selected the members of the group. Thus, even as they were deleted from Deny, they were still members through nesting.

I am sure that somewhere, someone is using nesting for good, instead of evil, though.

This discussion is closed to new replies.