Configuring Windows Groups

Add accounts to local groups. Manage local group memberships to ensure required accounts are present.

Note

This feature module is currently in review / under design and not yet available for production use.

Overview

The windowsGroups module is intended to manage local group memberships on Windows devices.

The original use case was narrow - adding specific accounts (e.g., INTERACTIVE) to local groups such as "Hyper-V Administrators" alongside enabling the Hyper-V feature. This remains a valid but limited scenario.

A broader concept is being explored: a manifest-based approach where a manifest file describes the expected members of local groups (users and groups). The module would then validate the actual group membership against the manifest and remediate differences - detecting unauthorized additions (e.g., unexpected accounts in the local Administrators group) as well as ensuring required members are present.

Design considerations

Open questions that will shape the final implementation.

• Manifest file defining expected group memberships (desired state)
• Detection of extra/unauthorized members added outside of default configuration
• Add and remove operations to bring groups into the desired state
• Reporting and logging of drift from the expected membership

Related resources

For more information, see the following resources.

Have an idea or want to help shape this module? Join the conversation in Discussions.

---

Page revised: March 4, 2026