Re: restricted groups

From: Cary Shultz [A.D. MVP] (cwshultz_at_mvps.org)
Date: 02/10/05 

Date: Wed, 9 Feb 2005 19:55:54 -0500

Al,

Because you need to create the GPO from a workstation on which you have
installed the ADMINPAK. You will not be able to do this when sitting on a
Domain Controller! It is well documented! 

-- 
Cary W. Shultz
Roanoke, VA  24014
Microsoft Active Directory MVP
http://www.activedirectory-win2000.com
http://www.grouppolicy-win2000.com
"Al" <Al@discussions.microsoft.com> wrote in message 
news:40FE30C7-1CB0-4623-906B-19247A4D82F0@microsoft.com...
>I have an application that all domain users must be able to run on a local
> machine. It requires them to be a member of the power users group.
> What I'm trying to do is under the default domain policy is use the
> restricted group setting to make the domain users group a member of the 
> local
> power users group. When I do this and the log on as a domain user and then
> try to run this application it fails. However if I manually add the domain
> users group to the power users account through the local users and groups
> management console the domain user is able to run the application.
> Why is the restricted group policy not working for me.

Relevant Pages

  • Big Trouble!
    ... I have a user that in Active Directory is assigned to the ... Domain Users Group and in their PC to the Power users ... users to the Power Users group from my Active Directory ...
    (microsoft.public.win2000.active_directory)
  • Re: allowing all domain user to be a powerusers on window XP
    ... You can add the domain users group to the power users group on any XP ... > personal client but is there a way to do it so that they are automatically ...
    (microsoft.public.windows.server.general)
  • Re: restricted groups
    ... on the focus of the school and the instructors of said school). ... Microsoft Active Directory MVP ... It requires them to be a member of the power users group. ... >>> restricted group setting to make the domain users group a member of the ...
    (microsoft.public.windows.server.active_directory)
  • Re: Least amount of privileges
    ... It depends on what the domain users group has for permissions. ... Does this third party program have a service account that runs the app for ... moving this app off of your sql server and put it on a seperate server. ...
    (microsoft.public.windows.server.active_directory)
  • Re: restricted groups
    ... Both Herb and Gary mention the need of this Adminpak ... and working from a workstation to get this to work. ... >>I have an application that all domain users must be able to run on a local ... It requires them to be a member of the power users group. ...
    (microsoft.public.windows.server.active_directory)