Let's see how local user group policy works.
So I'm going to do.
I created a local user and group policy GPO and I am going to go ahead and bring up Ed.
And the first thing I want to do is kind of show you.
I had mentioned that there are some differences in the per computer versus per user options under locally
users in groups.
Right now I'm under the price user option.
I'm going to go ahead and right click and say new local group.
And what you'll notice here is a set of options that do not appear under the computer side.
And that's the sad current user.
Remove the current user or do not configure for the current user.
So essentially what this allows you to do is, let's say, for example, I wanted to set the local administrators
group membership.
I could say add the current user and apply this policy.
And what that will essentially do is when the user logged on and processed this GPO, they would automatically
be added to the local administrators group.
And so essentially what you do is you get kind of dynamically adding the user to a whatever group you're
interested in instead of having to specifically specify the user.
And that can be really nice and flexible in certain situations.
But most of the time what I'm going to end up doing is managing local user in-group preferences through
the computer side because this is what I'm more interested in, managing it for the whole computer.
And so what I want to do is a couple of things.
First thing I want to do is I want to create a new local user.
And I'm going to call it.
I'm just going to say I'm going to call it a service account.
So service account.
Service account.
And I'll give it a full name of service account.
And.
Remember I said that password has been deprecated.
I don't have the hotfix applied so I can still enter it here.
And I'm going to go ahead and do that.
Even though I mentioned that, you know, typically you're not going to want to use this feature going
forward because of that deprecated encryption capability.
So I'm going to say that the password never expires and that the account never expires.
And I'm going to go ahead and create this policy or this preference.
And here you'll notice that it warns me that the password is stored in six bullets and discoverable,
although obscured.
So it at least tells me that, hey, that password is probably not too secure.
So I've created this account called service account.
And now what I'm going to do is create a new local group preference.
And I'm going to add that new local account that I just created to the administrators group.
Now, if I browse to the domain, for example, I'm not going to know about that local account, so
I can just type the name of the account in here.
So I'm just going to say service account.
And let me just verify that.
That's correct.
And that is correct.
That's the service account.
So I've got this policy now, this preference that adds service account to the local administrators
group.
And now what I can do is I'm going to go ahead and link this GPO to the oh, you where my computer object
exists.
Remember, this is a per computer preference.
And now what I'm going to do is bring up my Windows seven client and go ahead and do a GP update.
And I'm going to target just the computer because I'm processing computer policy here.
And once that processes, I'm going to bring up the computer management MSI, snap in and refresh it
and look.
There's my service account.
And if I go into groups and go in under administrators, there's the service account added to the administrators
group.
So what I did there is I created a preference that created a new local account and added it to the administrators
group.
So that's a really nice feature to have.
I could have also just like restricted groups.
If you'll remember in restricted groups policy, I used restrictive groups to add the Help Desk Admins,
a global group to the Remote Desktop Users Group.
And I could do the same thing with preferences if I wanted to.
The ability to enforce that is a function of the fact that a normal non administrative user doesn't
have the ability to modify local groups or users.
So a preference is just as good as a restricted group policy in terms of its enforcement capability
by virtue of the fact that the user simply doesn't have a regular user, simply doesn't have security
rights to that particular area of the operating system.
So, you know, preferences is nice because it has a few more options than restricted groups do.
And it gives you some flexibility in terms of how you craft local group memberships and local user accounts.
But again, remember that the deprecated password support might eventually get in your way when it comes
to creating local accounts because most local accounts need some kind of password set.
So you may be able to create the account, but you wouldn't be able to use it until a password has been
set through some other means.