Windows Forum

Ask something
Discussion Locked

Creating A Power User In A Domain env.

0 helpful
10 replies

by gcheels

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am in the process of converting "workgroup" PC's over to a domain structure. What I've found is I have several users that run software that requires administrative/power user rights. Naturally, I can't give them administrator rights, but I wouldlike to know how to create a new user called "Power User" similiar to the local Power User group. Thanks.

10 replies

by acattr

1. It is impossible to create a Power User in a domain. What you can do is, give the group "Domain Users" administrative/poweruser rights to thier local machines. But, do not add all users to the "Domain Admins" group of the domain. That way theycan run/install what ever applications they want on thier machines, but can't do anything on the Servers. I don't like giving users full access to thier machines so #2 may be better.

2. You can hack this problem. Some dumb applications require read/write access to thier install directory and/or the registry. You can give your users read/write access to the install directory and hope that it gets the Application working. If not, you may need to use regedt32.exe and give users permission to the registry keys that the application uses. First making sure they have read access, then read/write. If all else fails read/write access to the entire registry will do the trick, but at the price of giving them full access to it. I've done thiswith applications like quickbooks.

by acattr

line 1 should read

"1. It is NOT impossible to create a Power User in a domain. "

by bill rankin

The rest of the answers are correct - You cannot create a Domain Power User.

BUT - here's the solution to your question(assuming NT 4 domain structure, as no info is given):

1. Create a Domain Global Group called "Power_Users".

2. Add thespecial group of users that you want having the "Power User" priveledges, to the Domain Global Group called "Power_Users".

3. Run this script on each system - (net localgroup "Power Users" "Your Domain\Power_Users" /add).

Benefits - It will allow you to manage the Power Users centrally, making it easier to add and remove folks as needed.

Remember - manage resource permission by group - its quicker.

G'luck - Bill

by bill rankin

I disagree with answer #3 - here's why:

#1 - The data, under ideal conditions, should be ona server with NTFS permissions - status - secure.

#2 - Local data should be on a second partition. Here's why. If the OS or the apps screwup on the C: partition, the data is safe on the D:. You can reformat C; and reinstall (Ghost if you're smart) and no data loss. The designated user has full control over the NTFS partition of the D: drive, and can be remotelly managed by the sys admin.

#3 - No data is safe on a system that can be physically accessed by anyone with a special NTFS access Linux boot disk. Local admin password gets hacked and you can get whatever you want.

Review #1 is best and most secure, plus allows for central tape backup. #2 will work in a pinch, so long as the system is locked up. Otherwise, #3, no system is secure thats not physically secured.

Bill

by chris

What the others mentioned is possible - but they don't address security. If you put everyone in a "Domain Power Users Group" and put that group in every machine's local "Power Users Group" - then everyone will have access to each other's systems. Potentially giving them access to information they shouldn't have.
I would think it is best to put only the user of the computer in the power users group - not everyone.
That is just my 0.02?

This discussion is closed to new replies.