Re: Changing Users Primary Group.

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance


"Michael-Dallas" <MichaelDallas@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:06FE5531-FDEC-41D8-BA1E-D4B6B83A006A@xxxxxxxxxxxxxxxx
Other than a few small things on the impact of changing a users primary
group, anything that someone can speak up on with issues or functionality
issues with this? Where I have taken over a domain there are accounts
that
have had this group changed, more on that is that the group "domain users"
has been removed. From what I have found thus far is that they are
contractor accounts and they did it probably because "it limits the access
to
any system in the environment". Well, I have my say on that comment but
that's an internal discussion....

I (probably) agree with you. Someone else may comment on subtleties I
don't know since I haven't looked into this in years but older versions the
"primary group" was mostly relevant to Mac (etc) clients and due to the
fact you couldn't get someone OUT OF "Domain Users" until you set
them into some other group AND set that as primary.

Being hidden as a memberOf value and need for POSIX are the only things
that
I can find thus far. Not to mention "you don't need to do it". Anyone
got
some Security or functionality items of reference on changing the Primary
Group to an alternate group?

Thanks in advance.


.

Relevant Pages

  • Re: User configuration question
    ... Those accounts are configured ... where use of the security group of these web users in the policies ... > There's only one network card in the system, ... > I've also found out that I can even remove them from the "Domain Users" ...
    (microsoft.public.windows.server.security)
  • Re: Domain account iwth restricted rights
    ... Normally the "Authenticated Users" special group has the logon locally ... The Domain Users causes the "Logon Locally" right to be present ... So you need both different permissions and different rights perhaps. ... What is the best way to lock down these accounts? ...
    (microsoft.public.windows.server.active_directory)
  • Re: Domain account iwth restricted rights
    ... primary group and each was removed from Domain Users. ... The Domain Users causes the "Logon Locally" right to be present ... So you need both different permissions and different rights perhaps. ... What is the best way to lock down these accounts? ...
    (microsoft.public.windows.server.active_directory)
  • Re: Changes to ACL disappear
    ... > inheritance on the adminSDHolder container will stop the ACE entries from ... > service accounts to set the AdminCount to 0. ... > "Domain Users' from "Print Operators" for this to work. ...
    (microsoft.public.windows.server.security)
  • Re: Creating Computer Accounts in the Active Directory
    ... I have tried Domain Users; that did not work correctly either. ... and the Administrators are nested in FAR too many ... >> accounts in the Active Directory using VBScript. ... >> specify a GROUP that may join to the machine to the domain other than ...
    (microsoft.public.windows.server.active_directory)