Re: Local Computer Access In AD

"Lars Bengtsson" <LarsBengtsson@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:F3D9A05E-34A3-450D-8FC1-087D6CE3EB37@xxxxxxxxxxxxxxxx
We have a few special programs here at the hospital.
Some people needs more access than standard user to their local computers.
I Dont want to give these people admin access.

You need to first catalogue what specific privileges
are required, and who requires them (everyone may
not require the same privilege and Power User
may be either too much OR too little.)

How do I create a power user group that I can add users to and so it
applys
to all computer they access?

There is already a Power Users group on every
(non-DC) computer, which is granted some extra
privilege.

Until you know precisely what priveleges are required,
and by whom, you will not be able to intelligently and
safely allow the correct access.

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

"Herb Martin" wrote:

"Lars Bengtsson" <Lars Bengtsson@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message
news:CC34B8DE-5560-4E8A-86BC-E528ED709C07@xxxxxxxxxxxxxxxx
How do I give domain users access to programs that are installed with
the
administrator account?

Depends on the program. If the program requires no special
privileges then you merely move the shortcuts from the
Admin's profile to the All User's profile.

How do I give them access to install their orn programs?

In general, users can install their own programs. It is
actually VERY DIFFICULT to prevent this completely.

What specifically would you want them to run or install?
(It matters quite a bit.)

How do I make them a power user on the local computer?

Add the user to the Power Users group.

OR use a restricted group to add the "Interactive" group
to the Power Users group. Whoever can logon would be
a Power User.

Why do you need them to be power users?


--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]





.

Relevant Pages

  • Re: Allow user to run application as a power user
    ... > the system context that makes the current logged on user a member of the ... > Finally, after the application is complete, the script, under the system ... > Since we don't normally allow membership in the power users group, ...
    (microsoft.public.scripting.vbscript)
  • Re: All users printers showing up on terminal server
    ... This is not the case for you since your application will run okay with Power Users membership. ... A member of the Power Users group may be able to gain administrator rights and permissions in Windows Server 2003, Windows 2000, or Windows XP ... When the users log onto TS all the redirected printers are show on the ...
    (microsoft.public.windows.terminal_services)
  • RE: Power Users change?
    ... the rights and permissions that are granted to the Power Users ... members of the Power Users group to modify computer-wide settings, ... install drivers, and to run non-certified programs. ...
    (microsoft.public.windows.server.migration)
  • Re: Local Computer Access In AD
    ... Not if you use the Restricted Group through a GPO method ... You can put "interactive" in the Power Users this ... You need to first catalogue what specific privileges ... Add the user to the Power Users group. ...
    (microsoft.public.windows.server.active_directory)
  • Win2k Pro Local Groups
    ... Pro on them in a NT4 environment (no Win2k servers, ... access to install when they're in the Power Users group. ...
    (microsoft.public.win2000.security)