Windows Forum

Ask something
Discussion Locked

Domain Group Rights

0 helpful
5 replies

by tim.doyle

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm pretty rusty so bear with me. I have an NT4 domain and a number of XP and 2K clients. Problem is I can't seem to allow the users administrative access to their machines without adding them to the Domain Admins group. I figure I want to createa Power Users group which will allow them to add printers and install updates to their PC's and such without giving them full domain access.

I tried creating a local administrative profile with the same name as their network user, but when they log on the domain overrides their local user policy. If I add them to Domain Admins the problem goes away.

How do I create the group I want and then how do I adjust the rights appropriately. I've been through my books and Domain Administrator but can't seem to nail this down.

Thanks in advance.

5 replies

by 93961

You can include the user's domain account in the "administrators" group of the local Domain of the client machine. He/She will have the administrative rights of the local machine he/she is using. This can be done in the local Domain User Manager.

by tim.doyle

As mentioned above, I did this and it doesn't seem to work. It used to work for NT workstation, but it does not work in the same way with 2k and XP clients. The only way the user can then gain administrative access to their computer is if they sign off the network and log into their workstation only, which gives them a different desktop and everything since its a totally different profile by the same name.

by joseph moore

It is actually easy.

Method 1:

While the user is logged into the Win2K/XP workstation:

Click on Start -> Settings ->Control Panel
(I know, WinXP pathing does not have the Settings option)
to open Control Panel
Now, double-click on Administrative Tools (and I forget what they call it in XP!)
Ok, time for the RUNAS trick! Hold down a SHIFT key, and right-click Computer Management.
In the popup box, click RUNAS
Select the choice "Run the program as the following user" and put in your administrative credentials. You want to run this under YOUR admin security context, not the local user context!
Ok. Now when Computer Management opens, expand Local User & Groups snap-in.
Expand Groups.
Double-click on Administrators
Click the Add button
In the Domain drop-down, select the name of your NT4 domain.
Then, scroll down the list until you find the user name you want to be a local Admin on the specific workstation you are on. Select that user, then click OK.
Click OK to savethe changes.
Have the user log off.
Now, have that user log into that workstation, and they should be a local Admin!

by joseph moore

Here is another way to do it.
Method 2:

Now, another way to do this involves logon scripts. IF you run logon scripts, you can put this in the script to do it when the user logs in (to avoid YOU having to go to each workstation to fix this).
First, you say your users are currently set up as Domain Admins. Ok. Keep them as such for this to work. Being a DA will give the specific users the rights needed so they can add themselves as local Administrators.

In your logon scripts, put the following line in:

NET LOCALGROUP ADMINISTRATORS %USERNAME% /ADD

That is it. Have your users log out, and log back in.

So, when the user BOB in domain DOMAIN logs into workstation \\WORK1, this script line will run, and it will add DOMAIN\BOB as a member of the local Administrators group on \\WORK1.
If BOB were to log into \\WORK2 then it would add BOB as a local Admin there also.

When you have the correct users listed as local Administrators on the correct machines, then remove all ofthese users from being Domain Administrators.

At that point, you are done!

by joseph moore

Personally, the logon script method cuts down on the number of desktop trips you need to make (zero necessary) so that is a good thing! But, I hate having users have any power (especially being Domain Admins!) so I would be apprehensive. But, since you already have them as such, then it shouldn't be a big concern.

hope this helps

This discussion is closed to new replies.