Adding users in Local Administrators Group using GP Restricted Group

Hi Experts.
I have approx 200 servers. There are user1, user2 and user3 which I have added in
Local Administrators Group using GP Restricted Group in all 200 servers. This works fine. In Add Group option I added "Administrator" and Added user1, user2 and user3 in "Members of this Group". Now all 3 users are reflected as a Local
Administrators member.
Now there is a need that user 4 should be in Local Administrators Group using GP Restricted Group for certain servers only. Lets say 50.
In Add Group option I added "Administrator" and Added user4 in "Members of this Group". BUT it doesn't work.
Any idea?
Regards Suman B. Singh

Hi,
How is it going? I agree with Martin. To do this, we can configure the setting in two different GPOs. For instance, in GPO1, we add user1, user2, and user3 to the local admin group; in GPO2, we add user1, user2, user3, and user4 to the local admin group;
and then we can use Security Filtering to apply the specific GPOs to specific computers.
Regarding security filtering, the following article can be referred to for more information.
Security filtering using GPMC
https://technet.microsoft.com/en-us/library/cc781988(v=ws.10).aspx
Filter Using Security Groups
https://technet.microsoft.com/en-us/library/cc752992.aspx
Besides, in addition to Restricted Groups, we can also use Group Policy Preferences Local Users and Groups to do this, in which way we can configure two Local Group items in one GPO and utilize Item-Level Targeting to apply the specific items to specific
computers.
Regarding GPP Local Users and Groups, the following article can be referred to for more information.
Configure a Local Group Item
https://technet.microsoft.com/en-us/library/cc732525.aspx
How to use Group Policy Preferences to Secure Local Administrator Groups
http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/
Regarding Item-Level Targeting, the following article can be referred to for more information.
Preference Item-Level Targeting
https://msdn.microsoft.com/en-us/library/cc733022.aspx
Best regards,
Frank Shen

Similar Messages

CSM per admin group using per device group

I am looking to see if multiple admin and device groups can be created to limit certain administrators to administrate only certain devices but not others.
For example:
admin group "ag_na" (including user admin1 & admin2) can make changes to device group "dg_na" containing (device 1, device 2) only
admin group "ag_ca" (including user admin3 & admin4) can make changes to device group "dg_ca" containing (device30 & device31) only
Any tips on if / how to do this?
Thanks

You can do it by integrating the CSM into an ACS v4.2 and doing RBAC. There you can define for which NDGs a user has which access policy.
http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/4.1/installation/guide/aduser.html#wp1063220
Unfortunately this is a short-therm solution as ACS v4.2 has been put to EoS and no real alternative methods are available today. Hopefully Cisco will come up with a new solution on the long-therm.

Adding user to local admingroup win7

i'm using ICE, and have created an answer file.
What is the exact syntax to make a user member of local adminsitrators
I typed Administrators for the acount group membership but that doesnt seam to work ?.

Are you sure that you type "Administrators" correctly? As an alternative you can add a "NET GROUP
groupname username /ADD" command to your configuration.

Adding user to the oracle database using database link - is it possible?

Hi, i wolud like to manage my databases using one client. I easilly operate on my distriubuted tables but i have problem with creating users in distribiuted database. Is it possible to create users in distributed database using database links? or it have to be done locally using some stored procedures or sth similar?

The SQL syntax of the CREATE USER statement doesn't support DB links, the only way to do it would be with stored procedures. There might be an Oracle SP for that or for generic remote execution of SQL, but I'm not familiar with such.

What is the difference between using the command "dsmgmt" and the "Managed By" tab when adding users to the local administrators Account on a Read-Only Domain Controller?

When I use the
"dsmgmt" command to add a user to the local administrators account of a RODC I can actually see the user when I use the "Show Role Administrators" parameter. However, I can't see the members of the
group added to the "Managed By" tab of the RODC object in AD. Even though, the users added using
"dsmgmt" and by the "Managed By" tab can all log in locally and have admin rights to the RODC. Are there any differences between these two ways of adding users to the local administrators account?

Hi,
For groups, managedBy is an administrative convenience to designate “group admins”. Whatever principal listed in
managedBy gets permission to update a group’s membership (the actual security is updated on the group’s AD object to allow this).
In Win2008 and later managedBy also became the way you delegated local administration on an RODC, allowing branch admins to install patches, manage shares, etc. (http://technet.microsoft.com/en-us/library/cc755310(WS.10).aspx).
On the RODC, this is updating the RepairAdmin registry value within RODCRoles.
So the difference between them should be only the way they do the same thing.
For more details, please refer to the below article:
http://blogs.technet.com/b/askds/archive/2011/06/24/friday-mail-sack-wahoo-edition.aspx
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Can not add Domain User to Local Admin Group Win8.1

Hello,
I am trying to add a domain user to the local admin account on a Win8.1 Enterprise computer. When I click the check name button it asks me to enter network credentials even though I am signed in to the computer with a domain admin account. When I try to
type in any of my domain admin accounts it says "The Username or Password is incorrect". Even though I used that same account to login with. I can successfully ping all 3 of my DCs from the computer and have tried putting my second DC as the primary
DNS and my third DC as the primary DC and same problem. I have checked for Active Directory errors on the DC and everything says it is running fine on the DC in server manager. I have this problem on multiple computers. Some of the computers it will work on
but 90% of them it won't allow me to add the local user to the local admin group.
DCs are running Win Server 2008 R2 Enterprise.
Any help would be greatly appreciated.
Thank You

I would suggest you to use Restricted Group(via GPO) to add domain users/group to a local admins group
1)Create a new group in Active Driectory
Create a new group in Active Driectory that you wish to add to every workstations local administrator group. DO NOT add any users to this group at this time.
2.
Create a new GPO
Create a new group policy object and link it to the desired OU. Make sure that the GPO you are using covers the OU that the WORKSTATIONS you are wanting to give users local administrative rights over.
3.
Edit the newly created GPO
Navigate within the newly created GPO to Computer Configuration -> Policies -> Windows Settings -> Security Settings --> Restricted Groups
4.
Add your new Active Directory group to the Restricted Group
Right-click the Restricted Groups folder and select "Add Group" to add your new Active Directory group to the Restricted Group. In the Group field, type the name of the newly created Active Directory group and click "OK"
5.
Add the Restricted Group to the local administrator group
In the Restricted Group Properties windows click "Add" under the section titled "This group is a member of:" Type "Administrators" (without the quotes and yes it is plural), in the Group Membership window and click "OK"
6.
Wait for GPO updates to apply to the workstations
Once your users receive their updated group policy settings every workstation within the OU you specified will have your new Active Directory group as a member of the local administrators group. If you need to force the GPO update on a specific workstation,
run "gpupdate /force" in a command window on that workstation.
7.
Add a user or group of users to the Active Directory Restricted Group
When you are ready, or in a position where you need to provide local workstation admin rights you can simply add the users or group of users to the Active Directory group that you created for use with Restricted Groups within your Active Directory Management
Console.

Providing users the ability to Merge using a DAT file under Windows 7

Hello,
Our organization uses older software that uses Word Templates with Merge Fields, pulling data out of a SQL database. The software itself is old and out of date, but still works under Windows 7. The problem I am having is that the software will
place its own macros inside of Normal.dot to properly merge fields using the Word Templates.
Each Merge document accesses the application folder and goes into a sub-folder to access a file called WORDDATA.DAT that is the data source for the merge. Each workstation has their own WORDDATA.DAT file stored locally in C:\APPLICATION\temp\
In XP (we never used Vista), the proper way to get these merges to work was to do the following:
1. Provide Power Users (see below) with Modify rights to the main APPLICATION folder and propagate those rights down to all files underneath of it (including WORDDATA.DAT). We also had to remove inheritable permissions from the root drive (C).
2. Add Domain Users to Power Users group (for some reason the merges on XP would not work without this) so that anyone logging onto the machine could merge.
3. These templates required the Low security setting for macros in Word for the merge to work properly.
The problem I am facing now is that I cannot get the merges to work properly under Windows 7 Pro without giving the user Administrator rights on the local machine. This is obviously not a good idea. No matter what I try, nothing seems to work.
I've disabled UAC on these machines. Given Full Control rights to the application folder and all sub-folders and have even gone so far as to make the user the Owner of the application folder. But no matter what I do, the merge will not work unless
the user is added to the local Administrators group. I've also noticed strange behavior with WORDDATA.DAT, where it will not relinquish the Read-Only attribute. After running 'attrib' and stripping it of Read-Only and System attributes, the file
reverts to showing Read-Only in the properties. I don't know if this matters or not, but it appears as if Windows will not let anyone modify that file completely.
Does anyone have a suggestion for a workaround? Keep in mind, 1. Disabled UAC, 2. Running the application under Compatibility Mode for XP.
I realize we are using outdated software and this can cause some issues of course, but the basic principle of merging documents works. It has nothing to do with the application itself IMO but seems to be more of a security issue.

I guess I'm completely out of luck on this issue huh? The basics of the problem are simply that unless the user is added to Administrator local group on the Win7 machine, when the merge runs and has to use WORDDATA.DAT, it cannot and the merge fails.
Add the user as an admin and it works but this leaves our systems vulnerable, particularly with users who are happy to just double-click on any old attachment without checking it first.

Using Office 2013 group policy template to define Trusted Locations and Template Locations doesn't work

User Configuration/Policies/Administrative Templates
- Using Office 2013 group policy template to define Trusted Locations and Template Locations doesn't work
Microsoft Word 2013/Word Options/Security/Trust Center/Trusted Locations
- Allow Trusted Locations on the network:
Enabled
- Trusted Location #1:
Enabled
Path: //server/sharedfoldername [Edit: Path:
\\server\sharedfoldername]
Date: June 10, 2013
Description: Trusted Location
Allow sub folders: Enabled
The policy appears to apply to the client correctly by adding the following registry key and values:
HKEY_CURRENT_USER\Software\Policies\Microsoft\office\15.0\word\security\trusted locations\location1
allowsubfolders: 1
date: June 10, 2013
Description: Trusted Location
Path: //server/sharedfoldername [Edit: Path:
\\server\sharedfoldername]
However, when you open Word Options/Trust Centre/Trust Centre Settings…/Trusted Locations
There are no trusted locations listed under ‘Policy Locations’
I have tried setting similar settings for setting the Shared Templates folder location and just like the trusted locations policy, the registry keys are created properly in HKEY_CURRENT_USER\Software\Policies however word doesn’t
seem to recognize these either.
This used to work flawlessly using the administrative templates for Word 2007 and 2010. Has anyone been able to get these policies to apply successfully, or know why office doesn’t recognize these settings from the Policies registry
Key?

This would have been an easy solution to the issue. Unfortunately it isn't the problem. This question was originally posted on another Microsoft site and
was transferred here and when it was transferred the path's changed from the original post:
\\server\sharedfodlername to //server/sharedfoldername. (I will edit the question to show up as it did in the original post) Not sure how that happened. This
is still an issue that I haven't been able to get working correctly.
As it turns out the 'New from Template' interface Word 2013 has developed is very bulky with large thumbnails and is not very customizable nor practical for an office
that has a large number of templates. Because I am unsatisfied with the display and performance of the 'New' template chooser I sought after a solution to change the way word creates a document from a template in another thread:
http://answers.microsoft.com/en-us/office/forum/office_2013_release-word/how-can-you-change-the-display-of-templates-in/d49194b9-a6b4-4768-8502-7d7b50e9dd65 working through this issue with Jay we were able to develop
some VB script with handles a very large number of templates in a list view and it works much faster than the built-in Word interface. The above thread is how I've worked around trying to define a shared template location and I am quite happy with it.

Restricted Groups - Help Required to Cutdown more poilcy

Hi,
We have around 1000 Server in Domain, where in different OU, However it depends on the Application or role, GPO has been created for adding restricted group for individual server, As referring below the amount of GPO is Keep increasing,
Do we have any option to cut down the Policy common for a OU or some script can be amended ,.. Any suggestions Appreciated.

> depends on the Application or role, GPO has been created for adding
> restricted group for individual server, As referring below the amount of
> GPO is Keep increasing,
Use GPP "Local Users and Groups" instead of restricted groups... This
will allow you to put all your group configuration in ONE gpo and do
item level targeting for specific groups only.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Adding a domain user to Local Admin Groups using MDT 2012

I don't know if this will help anyone, but it did me after weeks of searching. If you are trying to add a domain user or domain groups to the local administrators group using MDT, simply go to the cs.ini and add "SkipAdminAccounts=No".
But the administrators accounts page will only appear if you choose to join a domain.

Correct, if you were to go into the %DeployRoot%\Scripts\DeployWiz_Definition_ENU.xml file you would see the entry for the DeployWiz_AdminAccounts.xml page as follows:
<Pane id="AdministratorAccounts" reference="DeployWiz_AdminAccounts.xml">
<Condition><![CDATA[ UCase(Property("SkipAdminAccounts")) = "NO" and UCase(Property("DeploymentType"))<>"REPLACE" and Property("DeploymentType")<>"CUSTOM" and Property("JoinDomain") <> "" ]]></Condition>
</Pane>
Most Wizard Pages are displayed by default, and you can turn them off by using the SkipXxxXxxxxx Page variable to hide them during wizard execution. This page is different, since it was added for MDT 2012, the MDT team decided to leave it *OFF* by default,
instead you must explicitly turn off the SkipAdminAccounts variable by setting it to "NO".
Additionally, you would not need to display this page if you were running a Refresh or a Custom Task Sequence.
Finally, this page does not actually *create* accounts, instead it just adds pre-existing user accounts and adds them to the local Administrators group. This scenario is only valid when you are joining the machine to a domain, so you must Join to the Domain.
If you are interested in adding other local users to the Administrators Group, you should write a script to create the account(s) and add them to the local group. Windows 8.1 has some *gotchas* that have to do with Microsoft Accounts, but that's a different
Story :^).
Keith Garner - keithga.wordpress.com

VBS: Add domain user and group to local administrators

I have a piece of VBS code that I have modified that basically adds a specified domain user and group to the PCs local Administrators group. It works on Windows 7, but not on Windows 8 at all.
Call AddUserToGroup("./Administrators", "myDomain.net/NetworkAdminis")
Call AddUserToGroup("./Administrators", "myDomain.net/Domain Admins")
Call addDomainUser("myDomain", "myUserGroup")
Sub AddUserToGroup(local, domain)
Dim objLocalGroup
Dim objDomainGroup
Dim server
For Each server in servers
Set objLocalGroup = GetObject("WinNT://" & local & ",group")
Set objDomainGroup = GetObject("WinNT://" & domain & ",group")
With objLocalGroup
.Add(objDomainGroup.AdsPath)
.SetInfo
End With
Next
Set objLocalGroup = Nothing
Set objDomainGroup = Nothing
End Sub
Sub addDomainUser(strDomain, strUser)
Dim strComputer
Dim objWshNet
Dim objGroup
Dim objUser
Set objWshNet = CreateObject("WScript.Network")
strComputer = objWshNet.ComputerName
Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators,group")
Set objUser = GetObject("WinNT://" & strDomain & "/" & strUser & ",user")
If Not objGroup.IsMember(objUser.ADsPath) Then
objGroup.Add (objUser.ADsPath)
End If
Set objWshNet = Nothing
Set objGroup = Nothing
Set objUser = Nothing
End Sub
I have debugged the code line by line using VBA's IDE and there seems to be no error condition firing. It executes all lines, but it is not adding the users and groups as it did with Windows 7 and below. The script is being run as local administrator.

Hi,
The first step is to comment out your On Error Resume Next line and try again.
Don't retire TechNet! -
(Don't give up yet - 13,225+ strong and growing)

WINDOWS 8.1 - System Tools no longer displaying User and Group Settings after adding a new LOCAL user.

I jumped on my parents computer, which is on a domain. I added a new local user(with my live.com login) and gave it admin status. That's when the trouble began.
The main user profile disappeared. I used the command prompt fix (see other fixes) to add the missing user back into admin. I logged back in, and it set up the account for the first time (WTF?). I cannot access any files from the main account
(that I logged into just fine before to get this debacle started.)
When going to Local Computer Management --> System Tools, my users and groups tool is missing.
I ran lusrmgr.msc only to find out that the most current version of Windows 8.1 and this is what it said "This snapin may not be used with this edition of Windows 8.1. To manage user accounts for this computer, use the User Accounts tool in the
Control Panel." <---- Awesome! (that was sarcasm.)
I have spent over two hours in the User Account tool during the course of this problem only to prove that a picture of a computer is more useful that that "tool".
To anyone reading this ticket, the best advice I can offer you (as long as its not a crucial machine) is to back up what you can gain access to, format your hard-drive and reinstall windows and start over again. I wouldn't recommend reinstalling 8.1,
I would say go back to 7 and wait until 10 comes out. Windows 8 is the new Vista. Good luck!

Hello AhavahOlam,
I can understand your feelings.
If my understanding is right, after adding a new local user in domain-joined Windows 8.1, you can’t open the local users and groups.
Can you still add account by going to Control Panel\User Accounts and Family Safety\User Accounts\Manage Accounts?
As this computer is domain-based, it is recommended to contact the domain administrator to see if the option is blocked.
Best regards,
Fangzhou CHEN
Fangzhou CHEN
TechNet Community Support

Group policy - restricted groups. How to specify a -local- user as member of the administrators group in group policy

Hi
With restricted groups I can specify the end user -domain- accounts that are members of the local administrators group on domain PCs. But - I need a particular LOCAL account on all the machines to keep its membership of the local administrators group for testing reasons. At the moment restricted groups is striping this local account of its admin access.
Is it possible to specify a -local- computer account as admin on all the PCs via group policy or it can only be done with domain accounts?
thanks

You are asking for local accounts to be managed via "Restricted Groups".
Yes, it is possible.
Rajesh showed you one way with domain groups. In his version "Administrators" group will only contain those accounts
that are specified in the GPO, no manually added accounts. This is not always desired.
If you wish to have an account (group or user, local or domain) to be added to "Administrators" group while keeping all the other
members, proceed like this:
- create the local account on the client(s)
- in the GPO select "Add Group" in "Restricted Groups".
- type in the name of the local account, e.g. "TestID"
- in the appearing dialogue choose "This group is a member of" => Add
- type in "Administrators"
Link the GPO and that's all.
The original MS description for "Restricted Groups".is here:
http://support.microsoft.com/kb/279301/en-us
Another nice one here:
http://www.frickelsoft.net/blog/?p=13
Besides that, a great solution to manage local accouts is GP Preference Extension "Local Users and Groups".
You can simply create a "Local Users and Groups" Item (computer or user based) and specify the needed options.
http://technet.microsoft.com/en-us/library/cc731972.aspx
Of course you need some prerequisites (at least one Vista or Winows 2008 for management and the GPP CSE on each target machine).
If you are new to GPP, these links will help you to get into it:
http://www.microsoft.com/DOWNLOADS/details.aspx?familyid=42E30E3F-6F01-4610-9D6E-F6E0FB7A0790&displaylang=en
http://support.microsoft.com/kb/943729/en-us
http://technet.microsoft.com/en-us/library/cc732027.aspx
http://technet.microsoft.com/en-us/library/cc731892(WS.10).aspx
Patrick

LDAP Query for particular user account in local Administrators group on All Enabled Computer Accounts

Need to query on all enabled computer accounts that have a particular user account present in the local Administrators group.
Ldap query is best, because not all our machines have SCCM client
Thanks for any help you can provide. Lisa

Ya, I have 41800+ computer accounts in my directory. I think that option is not feasible :) Thanks for your reply.
I can use SCCM to do this too, but only for those that the client is running on and which are online. Thanks again.
Hope is not all lost; a scripting solution is still possible. The difference is instead of running a central script to pull info from all computers, you let the computers report back to you with the info.
If I were you, I'd do the following:
1) Create a file share and adjust the permissions so that "Domain Computers" have "Modify" Permissions.
2) Create a script similar to the 2nd link I posted above, with a bit of adjustment: at the end of the script, write the information to the file share created in (1), and name the file
ComputerName.txt
3) Use Group Policy Preference Scheduled Task to deploy the script, and make sure it only runs once.
4) Happily wait for the results to come back :)
The main benefit of this approach is you're not restricted by the computer connectivity at the moment you run the script. This is especially true if you have many mobile computers in your environment. Just wait for a reasonable time (they all need
to come back to the mother ship once a while don't they?) and the results will show up in the file share you created.
Cheers.

Field GROUPS not a member of INPUT when adding user to group in sap using BAPI_USER_CHANGE

when trying to add User to Group using BAPI_USER_CHANGE in the Import Parameters GROUPSX = X
I'm getting following error :
com.sap.conn.jco.JCoRuntimeException: (127) JCO_ERROR_FIELD_NOT_FOUND : Field GROUPS not a member of INPUT
BAPI_USER_CHANGE function work correctly for other parameters such as ADDRESSX, DEFAULTSX, PASSWORDX, LOGONDATAX, ALIASX
But in case GROUPSX I am getting above error.
Also I could able to add all above attributes including GROUPSX to user using sap logon. so it should be possible from BAPI as well.
Any input will be appreciated.

My bad,
I meant GROUPS is not an input parameter but a table parameter.
This is the ABAP definition of the BAPI:
function bapi_user_change.
*"*"Lokale Schnittstelle:
*" IMPORTING
*"     VALUE(USERNAME) LIKE BAPIBNAME-BAPIBNAME
*"     VALUE(LOGONDATA) LIKE BAPILOGOND STRUCTURE BAPILOGOND OPTIONAL
*"     VALUE(LOGONDATAX) LIKE BAPILOGONX STRUCTURE BAPILOGONX
*"       OPTIONAL
*"     VALUE(DEFAULTS) LIKE BAPIDEFAUL STRUCTURE BAPIDEFAUL OPTIONAL
*"     VALUE(DEFAULTSX) LIKE BAPIDEFAX STRUCTURE BAPIDEFAX OPTIONAL
*"     VALUE(ADDRESS) LIKE BAPIADDR3 STRUCTURE BAPIADDR3 OPTIONAL
*"     VALUE(ADDRESSX) LIKE BAPIADDR3X STRUCTURE BAPIADDR3X OPTIONAL
*"     VALUE(PARAMETERX) LIKE BAPIPARAMX STRUCTURE BAPIPARAMX
*"       OPTIONAL
*"     VALUE(COMPANY) LIKE BAPIUSCOMP STRUCTURE BAPIUSCOMP OPTIONAL
*"     VALUE(COMPANYX) LIKE BAPIUSCOMX STRUCTURE BAPIUSCOMX OPTIONAL
*"     VALUE(SNC) LIKE BAPISNCU STRUCTURE BAPISNCU OPTIONAL
*"     VALUE(SNCX) LIKE BAPISNCUX STRUCTURE BAPISNCUX OPTIONAL
*"     VALUE(BACK_DISTRIBUTION) LIKE BAPIFLAG STRUCTURE BAPIFLAG
*"       DEFAULT SPACE
*"     VALUE(PASSWORD) LIKE BAPIPWD STRUCTURE BAPIPWD OPTIONAL
*"     VALUE(PASSWORDX) LIKE BAPIPWDX STRUCTURE BAPIPWDX OPTIONAL
*"     VALUE(ADDCOMX) LIKE BAPIADCOMX STRUCTURE BAPIADCOMX OPTIONAL
*"     VALUE(REF_USER) LIKE BAPIREFUS STRUCTURE BAPIREFUS OPTIONAL
*"     VALUE(REF_USERX) LIKE BAPIREFUSX STRUCTURE BAPIREFUSX OPTIONAL
*"     VALUE(ALIAS) TYPE BAPIALIAS OPTIONAL
*"     VALUE(ALIASX) LIKE BAPIALIASX STRUCTURE BAPIALIASX OPTIONAL
*"     VALUE(GROUPSX) LIKE BAPIGROUPX STRUCTURE BAPIGROUPX OPTIONAL
*"     VALUE(UCLASS) TYPE BAPIUCLASS OPTIONAL
*"     VALUE(UCLASSX) TYPE BAPIUCLASSX OPTIONAL
*"     VALUE(EXTIDSX) TYPE BAPIUSEXTIDX OPTIONAL
*"     VALUE(PRODUCTIVE_PWD) TYPE BAPIFLAG-BAPIFLAG DEFAULT SPACE
*" TABLES
*"      PARAMETER STRUCTURE BAPIPARAM OPTIONAL
*"      RETURN STRUCTURE BAPIRET2
*"      ADDTEL STRUCTURE BAPIADTEL OPTIONAL
*"      ADDFAX STRUCTURE BAPIADFAX OPTIONAL
*"      ADDTTX STRUCTURE BAPIADTTX OPTIONAL
*"      ADDTLX STRUCTURE BAPIADTLX OPTIONAL
*"      ADDSMTP STRUCTURE BAPIADSMTP OPTIONAL
*"      ADDRML STRUCTURE BAPIADRML OPTIONAL
*"      ADDX400 STRUCTURE BAPIADX400 OPTIONAL
*"      ADDRFC STRUCTURE BAPIADRFC OPTIONAL
*"      ADDPRT STRUCTURE BAPIADPRT OPTIONAL
*"      ADDSSF STRUCTURE BAPIADSSF OPTIONAL
*"      ADDURI STRUCTURE BAPIADURI OPTIONAL
*"      ADDPAG STRUCTURE BAPIADPAG OPTIONAL
*"      ADDCOMREM STRUCTURE BAPICOMREM OPTIONAL
*"      GROUPS STRUCTURE BAPIGROUPS OPTIONAL
*"      PARAMETER1 STRUCTURE BAPIPARAM1 OPTIONAL
*"      UCLASSSYS STRUCTURE BAPIUCLASSSYS OPTIONAL
*"      EXTIDHEAD STRUCTURE BAPIUSEXTIDHEAD OPTIONAL
*"      EXTIDPART STRUCTURE BAPIUSEXTIDPART OPTIONAL
So the error message is correct, GROUPS is not an INPUT parameter.

Adding users in Local Administrators Group using GP Restricted Group

Similar Messages

Maybe you are looking for