MicrosoftI tested this all weekend. I found that the first time a created a group called wacgatewayadmin. it showed as a WAC gateway administrator for some time and then reverted to a user group!
I verified in the Har file, the group said gateway administrator but was not functioning as a gateway administrator! it was showing under users!
I finally did get a second group to also be a gateway administrator and the har looks encouraging. but the other group had to match the built-in group in every way!
Steps
1. Create a new AD group based off the builtin administrators (copy)
2. Add the same membership to that group
3. Add wacgatewayadmin to the WAC credssp admin group
4. Add wacgatewayadmin to the local Administrators group.
I get the following in the HAR browser logs:
[{"name":"BUILTIN\\Administrators","type":"SecurityGroup"},{"name":"rreerc\\wacgatewayadmin","type":"SecurityGroup"}]
I removed myself from the entire administrator group membership- at least locally
IT does seem to be working, but I am concerned it is going to revert the whole group again. FYI- it seems you can make another built in group as the gateway administrator but - no spaces in that group and it has to be in the Builtin OU of AD.
and you see now i show two gateway administrators and it seems to hold
Good Luck
PS i did check the event log- and the only reason this is working is because the group is in the builtin group.
That restriction is still there.
