Find who removed a security group from administrator group

Question

Hi,

A security group is part of the Administrator group in Windows 10 64 bit Domain Joined Computer. This group is getting removed when a group policy update happens or during the restart of the computer.

Refer the below event log

How do i find which Group Policy or process removes the administrator access. I generated GPO report and it did not help. Also tried with Procmon and i do not know how to use to find what is the change happened.

How can i find what is causing the account removed from Administrator Group. Please help.

Answer 1

Hello,

Thank you so much for posting here.

According to our description, the security group is getting removed when group policy refreshes or during the restart of the computer. It seems like effected by the group policy "Restricted Groups" or "Local Users and Groups" Group Policy Preferences.

Restricted Groups allows you to overwrite the existing local group with what you have configured in the Group Policy setting. Restricted Groups can be configured by opening a GPO and navigating to the following location: Computer Configuration/Policies/Windows Settings/Security Settings/Restricted Groups

If you create a Restricted Group for the Local Administrators group, the GPO will overwrite the existing local group membership and set the membership to whatever has been configured in the GPO. If a user adds himself to the local administrators group, the next time the policy refreshes, the local group membership will reset back to what is defined in the Restricted Group.

Another option to manage local group membership is to use Group Policy Preferences (GPP).To configure Group Policy Preferences, simply open a GPO and navigate to Preferences, then expand Control Panel Settings. It is under both Computer Configuraion and User Configuration.

When you right-click and create a new policy, you will have the option to add, remove or even modify local group membership. For example:

So to check this issue, we could run gpresult /h C:\report.html  to get the GPO report and then check whether the above two settings are configured.

For any question, please feel free to contact us.

Best regards,
Hannah Xiong

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.