Home / server / Questions / 616280
Accepted
Matthias Güntert
Asked: 2014-07-30 04:32:32 +0800 CST

How to define the built-in administrators group in a group-policy object?

  • 772

How do I define the built-in administrators group in a group policy? For example 

Computer Configuration => Policies => Windows Settings => Security Options => Local Policies => User Rights Assignment => Adjust memory quotas for a process

Do I need to set the string "BUILTIN\Administrators" or just "Administrators"?

What about "LOCAL SERVICE" and "NETWORK SERVICE"?

Do I need to set "NT AUTHORITY\LOCAL SERVICE" or just "LOCAL SERVICE"?

Microsoft documentation is very misleading and incomplete in that respect. Thanks in advance!

group-policy

1 Answers

  1. Best Answer

    Do I need to set the string "BUILTIN\Administrators" or just "Administrators"?

    What about "LOCAL SERVICE" and "NETWORK SERVICE"?

    Do I need to set "NT AUTHORITY\LOCAL SERVICE" or just "LOCAL SERVICE"?

    You don't need the explicit BUILTIN or NT AUTHORITY at the beginning, as your domain should successfully infer it - there's only one group named Administrators, only one account named LOCAL SERVICE and only one account named NETWORK SERVICE.

    For future reference, when in doubt, keep two things in mind:

    1. You can use the Browse -> Check Names GUI options to have the proper object filled in for you.

      • If you're building a script based on this, you can then look up the properties, including the SID, of the object that's been filled in.

    2. As with anything else, when in doubt, specify explicitly or prefer a more qualified/distinguished named over a less qualified/distinguished one.
    • 2