Re: under a domain, how do i give users full control of their work

Well then your kind of screwed unless you really want to put ALL users
into a specific Security Group. Then if you wanted you could go to
the OU where your computers are stored in AD Users and Computers and
with in the Group Policy for that OU go to Computer Config - Windows
Settings - Security Settings - Restricted Groups and you can add that
Security Group you create that holds all the user accounts to the
Administrators group. Just be warned that if you did actually do
that, just about EVERY one of your PCs can be open to a TON of virus'
and security leaks.

We have to have each user an Adminstrator of their OWN PC, but then we
put the Domain Users group in the Local Power Users groups on each
PC. I know its not MUCH better than what I described above but it is
a tad bit safer.

On May 18, 6:53 pm, Allan <A...@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
omg, to every single computer??

what if a user wants to roam onto a different computer? how does this affect
them?



"Danny Sanders" wrote:
One way would be to visit each computer and put that user's domain account
in the local admin group.

Go to computer management (right click on my computer and select manage) -
local users and groups - groups - right click on administrator and select
add to group - add button and on the applet "select users, computers, or
groups" make sure the location is focused on the domain not the local
computer.

Add the users domain account to the group.

hth
DDS
"Allan" <A...@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:2AB80654-9872-40CC-AB50-3A191989D611@xxxxxxxxxxxxxxxx
I'm connecting approx 50 machines to active directory. (to a domain)..

we used to have 50 computers connecting to a winxp pro machine sharing
files.. (time to get a server) The main purpose is to share files.. We
were
previously using a workgroup environment... I'm now running Server 2003
Enterprise.. domains are fairly new to me.

I notice when the local workstations are a member of a domain, it's pretty
locked down (using default gpo settings), users can not change anything on
their machines, (internet explorer settings, install new programs, windows
update, click on the system time etc..)

i'm contantly being bother with I'm not able to do this or that..
How do I give full access to users, so that they can install their own
programs, do whatever they want on their on local machines? pretty much
like
full admin access to their computers. (they can trash their local machines
if
they want, not really a concern) At the same time, I would still like a
little bit of control over the users.

Is it done though Group Policies? There are so many group policies, how am
I
going to tag every single one? How do I know which one does what? There's
just too many.- Hide quoted text -

- Show quoted text -


.