This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hello Folks, Cannot add buitin groups in the properties of a user in Active Directory Example : I have user abc in xyz domain, I want to add the user as member of Builtin/Administrators and Builtin/Remote desktop users but i cannot add it. Need your suggestion. Regards, Arif![25971-sysadm1.jpg][1] [1]: /api/attachments/25971-sysadm1.jpg?platform=QnA
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 96%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFF%3C/text%3E%3C/svg%3E)
Hi，
Which user do you use to perform this operation?
When you said cannot add buitin groups, would you please show the error messages ?
Or you mean you can add the group ,but after sometime ,the membership would be changed?
Best Regards,
Hi，
Which user do you use to perform this operation?
Domain Admin and Enterprise Admin
When you said cannot add buitin groups, would you please show the error messages ?
Buitlingroups are added and after sometime its gets removed automatically ( No error )
Or you mean you can add the group ,but after sometime ,the membership would be changed?
Yes you are right !!
Regards,
Arif
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 80%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETB%3C/text%3E%3C/svg%3E)
Hi,
It seems that you have permission to edit this group.
You have to use a domain admin account.
Please don't forget to mark this reply as answer if it help you to fix your issue
HI,
I am doing the changes with domain admin.
Regards,
Arif
Hi,
It seems like effected by the group policy "Restricted Groups" .
I did a test in my lab, if i deploy a restricted Groups for the administrator groups , it will be the same result as you.
Result :we can add members in the administrators group ,but once the group policy was refreshed, the members added manually will be lost.
At this situation , we can only add the users by group policy you configured before.
The policy was deployed under Computer Configuration” > “Policies” > “Windows Settings” > “Security Settings”. Click on “Restricted Groups.
I would suggest you run a gpresult /h report.html and confirm where did the policy was configured and then through the GPO ,put the user into the administrators group and RDP user groups.
Best Regards,
Hi,
Thank you so much for your suggestion but unfortunately i don't have user or group in the restricted groups.
Regards,
Arif
Hi,
Would you lease run the cmd as administrator and type command :gpresult /h report.html on the DC and check the following settings:
If possible please share a screenshot .(Please hide the private information)
Best Regards,
Hi,
I don't have restricted group policy configured in my group policies.
I tried to move that users to another OU ( Test RDP ) and Blocked the inheritance for that OU but still no luck.
I have veeam backup in my environment and tried comparing the attributes of that user.
Regards,
Arif
Hi,
Was the issue for just one users or for all the users?
How about add the users from other DCs？
Fan
Hi,
This issue for single user only.
For other users and new users its working fine.
Regards,
Arif
Hi,
It's really strange !
The user was existed on all the DCs, right?
For test , can it be successful if you add the user into a security group and then add the group into the administrators group?
I would do more research about the it, if there are any progress, i would update here!
Best Regards,
Hi，
If possible, i would recommend you capture a network package and the processes for more details If you can find the time interval of group membership being changed .
Best Regards,
Hi,
I would do more research and if there are any information new , i would update here!
Best Regards,