To create a Restricted Groups policy
Open Security Templates.
In the console tree, right-click Restricted Groups.
Security Templates > Template path folder > Security template > Restricted Groups
Click Add Group.
In Group, type the name of the group for which you would like restricted policy and click OK.
To add members to the group, in the details pane, right-click the group you added and click Properties.
In NewGroup Properties, in the Members of this group box, click Add, and then type the member you would like to add. Repeat this step for each member you would like to add.
To add this group as a member of any other groups, in NewGroup Properties, in the This group is a member of box, click Add, type the name of the group, and click OK. Repeat this step for each group you want to add.
To open Security Templates, click Start, and click Run, then type mmc and click OK. On the File menu, click Open, click the console that you want to open, then click Open. Then, in the console tree, click Security Templates.
You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure. If your computer is connected to a network, network policy settings may also prevent you from completing this procedure.
Restricted Groups policy states that only the members that you have added can belong to that group. When the security template is used to configure a system, during the configuration, only members specified in Restricted Groups policy will remain members. Similarly, at the time of configuration, if the member does not belong to the group, they will be added to the group.
If there are no users in a defined restricted group, then all current members of that group are removed when you use the template to configure a system.
If a restricted group does not belong to other groups, no action is taken to adjust membership in other groups.
To copy all of the restricted group entries from one template to another, in the console tree, right-click Restricted Groups, click Copy, right-click Restricted Groups in the other template, and then click Paste.