How to configure Ad domain setting

For Windows 11 domain-joined computers, you can use the Restricted Groups security policy to add a domain security group to the local Network Configuration Operators group. This is a native Active Directory Group Policy solution for centrally managing local group membership.

Create a new GPO and link it to the OU containing the target Windows 11 computer accounts. Open Group Policy Management Editor and navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Restricted Groups.

Right-click Restricted Groups and select Add Group. Enter Network Configuration Operators, using the built-in local group name, and click OK. In the group's properties, under Members of this group, leave the setting unchanged. Under This group is a member of, do not add any groups unless you specifically need to configure its memberships. Instead, to add your domain security group to Network Configuration Operators, configure the policy using the correct membership direction: add the domain security group as the Restricted Groups entry, then specify Network Configuration Operators under This group is a member of.

This distinction matters because Restricted Groups has two different controls. Members of this group defines and enforces the complete membership of the selected group, potentially removing members not listed. This group is a member of adds the selected group to other groups without defining their complete membership. Using the second option avoids replacing the existing membership of Network Configuration Operators.

After configuring the GPO, run gpupdate /force on a target computer and verify the result with:

net localgroup "Network Configuration Operators"

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin