Windows Forum

Ask something
Discussion Locked

Granting admin rights to users

0 helpful
11 replies

by virgil_denny

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Does anyone know what is going on here? I can not grant full rights to users, although it says i have. When they are lopgged in to the domain, they cannot install software, or add hardware, but when logged into the machine, with admin rights, they can. Can anyone help? Thanks

11 replies

by dcraun

You can make them either a local Admin, or a Domain Admin. If they are local Admin, they have only full control of that machine. Where as Domain Admins have Admin rights to any machine in that domain.

by virgil_denny

Yes I found right after posting my original question. The best way is to go into the group administrators, and then add the user as they would log in, I.E. companydomain\jdoe. This solved the problem. When trying to add to the user instead of group, it only gave certain rights. Thank you everyone for your informative answers.

by abubin

i suggest only make them local admins cause this has more security.

You can do that by opening Users & Passwords in control panel on that local machine and then add user. Put that user domain name and then your domain. You can add by browsing too.

Then make this user the admin and viola. Your this user will have full access rights.

Another approach to this is only giving specified rights to this user. Such that if you only want this user to be able to install software, you can specifythis in System Policy. Even Group Policy can do that with better control but this is a little more tedius to implement.

by rcc

Hi
The whole idea behind NT 4 domain model is to provide secure environment, where users CANNOT MODIFY system components without contacting IS team first. I'd strongly suggest you review your needs, because granting them the rights to do so will render null most of the security.
If you still want to do this, I'd suggest you use a DOMAIN GLOBAL GROUP Power Users and add them to this one instead. This will at least leave your administrative groups unchanged...

Regards,
Radu

This discussion is closed to new replies.