Re: Restricted Groups - Local Users Group

Glad you got it sorted out though that alone would not explain why a regular
user seemed to have administrator powers. It probably is of little use to
try and user Restricted Groups to restrict the user local group on a domain
computer and best left to manage privileged groups. Keep in mind that you
can also configure the user rights for logon locally and access this
computer from the network to control what users/groups have interactive or
network access to the domain computers. --- Steve


"jmalloney" <jmalloney@xxxxxxxxxx> wrote in message
news:eF49Y0L0FHA.1028@xxxxxxxxxxxxxxxxxxxxxxx
> OK well I figured it out. When I added domain users to the local users
> group via Restricted Groups the policy removed the default INTERACTIVE and
> AUTHENTICATED USERS from the local users group. After I added the groups
> back into restricted groups my policy worked fine.
>
> Thanks for all your help!!
>
> "Steven L Umbach" <n9rou@xxxxxxxxxxxxxxxxxx> wrote in message
> news:um%23T6AE0FHA.664@xxxxxxxxxxxxxxxxxxxxxxx
>> Interesting. Verify that the regular user that you believe has excessive
>> access can run the command secedit.msc to open and edit Local Security
>> Policy. Double check with the command "net localgroup administrators"
>> that only the administrator and domainname\domain admins group is listed
>> as members. Then logon to the computer as the local administrator [non
>> domain account] to verify that the local administrators group has the
>> SID of BUILTIN\Administrators" S-1-5-32-544 by using the command whoami
>> /groups /sid. Whoami is part of the support tools. Logon as the domain
>> user who you believe to have excessive access and run the command whoami
>> /user /groups to check the group membership of his access token to see if
>> it is what you expect. Then run the command net group "domain admins" on
>> a domain controller to see if it is what you expect and remember any
>> domain user that is also in the domain admins group either directly or
>> via group nesting will be a local administrator on the domain computers.
>> On the domain workstation computer check the security logs for anything
>> unusual around the time you were logged on as a regular domain user after
>> making sure that auditing of logon events and account management is
>> enabled. If still nothing seems to explain your problem, move a domain
>> computer into an OU that is not using Restricted Groups and remove
>> everyone but the built in local administrator account from the local
>> administrators group and then logon to that computer as a regular domain
>> user to see what happens. --- Steve
>>
>>
>> "jmalloney" <jmalloney@xxxxxxxxxx> wrote in message
>> news:%23HOv6iC0FHA.1256@xxxxxxxxxxxxxxxxxxxxxxx
>>>I ran all commands and the result is the same as what I see in Users and
>>>Groups. Everything appears to be configured correctly. Again all
>>>"domain users" are in the local users group only, yet anyone who logs in
>>>appears to have local admin rights to the pc!!
>>>
>>> "Steven L Umbach" <n9rou@xxxxxxxxxxxxxxxxxx> wrote in message
>>> news:ertFZGC0FHA.1256@xxxxxxxxxxxxxxxxxxxxxxx
>>>> Something seems to be amiss. On a computer where this is happen use the
>>>> command net local group administrators to see exactly what users and
>>>> groups are in the local administrators group and for a user in question
>>>> run the command net user username to see the group memberships of the
>>>> user named in username. If you have any questions about the results of
>>>> those commands post the results here in a reply. Also in Active
>>>> Directory Users and Groups check the membership of the domain admins
>>>> group to make sure it is what you expect. --- Steve
>>>>
>>>>
>>>>
>>>> "jmalloney" <jmalloney@xxxxxxxxxx> wrote in message
>>>> news:%23uhYMJA0FHA.1924@xxxxxxxxxxxxxxxxxxxxxxx
>>>>>I have used restricted groups in GP to control membership of both the
>>>>>local users and administrators groups. I added the "domain users"
>>>>>group to "Users" and "Domain Admins" group to "Administrators". The
>>>>>main reason I did this was that I wanted all domain users to be
>>>>>restricted from making system-wide changes to their local pc. The
>>>>>policy worked as I could see that their local groups reflected my
>>>>>settings at the domain. The problem is that although domain users are
>>>>>in the "users" group they are still able to make system-wide changes.
>>>>>I tested this, as a user I can make myself a local admin, delete system
>>>>>files...etc...
>>>>>
>>>>> In the past I never used group policy for this. I would simply open
>>>>> control panel, users, and add the user to the "restricted users"
>>>>> group. This always worked well, and prevented them from making any
>>>>> critical changes to the system. My understanding was that the "users"
>>>>> in computer management was the same as the "restricted users" group
>>>>> shown in control panel\users. What am I doing wrong?? I want all my
>>>>> domain users to be restricted through group policy!!
>>>>>
>>>>> HELP!
>>>>>
>>>>
>>>>
>>>
>>>
>>
>>
>
>


.

Relevant Pages

  • Re: Admin user vs. Standard user
    ... even an administrator account doesn't let you do normal things like ... making the data inacessible when you change username. ... DOES THE STANDARD ACCOUNT ... "back door" in case something corrupts your regular account. ...
    (microsoft.public.windows.vista.general)
  • Re: how to sign on as administrator
    ... The standard security practice is to ... set a strong password on it and use it only to create another account ... reserving the Administrator account as a "back door" ... in case something corrupts your regular account. ...
    (microsoft.public.windowsxp.general)
  • Re: SBS 2008: administrator account
    ... Ultimately you can use whatever you want except Administrator here, but it's a good idea to NOT use your regular, preferred, login name. ... I am assuming that the administrator account that the system wishes to ...
    (microsoft.public.windows.server.sbs)
  • Re: Do I need Server8?
    ... "regular" version? ... administrator, and still use it for daily accessing of files when I'm ... Steeve, for the advanced one, you can use it as a "normal" FMP. ... "extra" features are only some help for developper job and don't change ...
    (comp.databases.filemaker)
  • Re: Is it really true that NTFS is secure?
    ... > and failure auditing starting with "Audit Account Management," and also try ... > The account Group got put back in the Administrator group again. ... > The logon to account: ...
    (microsoft.public.security)