Setting up user security

What I would do is set up the users accounts in the domain as regular users and then add that account to their machine's Administrators group. This way they'll only be able to do the administrative stuff locally and normal user activities on the server(s) in the domain.

-Matt

What I have done was giving them administraive rights.(what you want)

On the w2k server I gave only the domain admin right to logon locally. (administrative tools,domain security policy, local policies, user rights assignment)

leopold

Just add users to the Domain Admin group. This way they'll have admin rights on local machines. (But take sp.care to your server as this way they can access your server locally & remotely.)

To avoid local access (interactive) restrict users based on "Logon to" option. Which is available when you right click user & properties. & I think its 3rd tab. There ia a button Logon to. Click it & add PC name /s on which users can login. (Try this If users have fixed PC for login.)

There are two answers to your question.

1. If you want them to have admin right to local machine only, (which includes no access to network resoruces), then create a new user account for them or add existing user account to Admin group under Computer management-user&groups for Win2K PRO.

2. If you want them to have admin rights to local machine and needs to access network resources (such as another computers on the network), its better to create a new user account in the Domain (Active Directory). From there, see if u can get a pre-build in Group account that will do the job, such as Domian Admin Group. But is this person is a user and should not have access to sensitive materials, then its better creat a new Group with correct permissions and add the new user to the group.

Actually...

On your server under User Manager for Domains, make sue that your users are only in the groups that you want them in for the domain (i.e. Domain Users).

Logon to the W2K pro machine as administrator, goto user manager and add the user to the local Administrator group. On NT/2K machines there are two types of groups, local groups and domain groups. You won't be able to administer the domain groups from a workstation.

HTH