is not valid for the R (Restrict) action and will be ignored if present. 
Therefore, be very careful when specifying a SID to ensure it is correct.
When specifying a SID in the or, member SIDs are added without attempting to resolve them. The SID is present in the securityIdentifier attribute. Azure AD group SIDs can be obtained using Graph API for Groups. For adding or removing Azure AD groups using this policy, you must use the group's SID. and can use an Azure AD SID or the user's name. : Specifies the SID or name of the member to remove from the specified group. : Specifies the SID or name of the member to configure. This action provides the same functionality as the RestrictedGroups/ConfigureGroupMembership policy setting. This action must be used to replace current membership with the newly specified groups. This action must be used to keep the current group membership intact and add or remove members of the specific group. : Specifies the action to take on the local group, which can be Update and Restrict, represented by U and R: If there are multiple errors, the last error is returned at the end of the policy processing. If name/SID lookup fails, the group is skipped and the next group in the XML file is processed. If you specify a name, the LookupAccountName API is used to lookup the group and validate the name. If you specify a SID, the LookupAccountSid API is used to translate the SID to a valid group name. 
: Specifies the name or SID of the local group to configure. Here is an example of the policy definition XML for group configuration: Applying both the policies to the same device is unsupported and may yield unpredictable results. Starting from Windows 10, version 20H2, it is recommended to use the LocalUsersandGroups policy instead of the RestrictedGroups policy. However, it allows only for a full replace of the existing groups with the new members and does not allow selective add or remove. The RestrictedGroups/ConfigureGroupMembership policy setting also allows you to configure members (users or AAD groups) to a Windows 10 local group.
0 kommentar(er)
