Re: Rights Issues (i think) with domain pc's

From: Lanwench [MVP - Exchange] (lanwench_at_heybuddy.donotsendme.unsolicitedmail.atyahoo.com)
Date: 06/03/04


Date: Thu, 3 Jun 2004 10:12:45 -0400

walter wrote:
> I'm not really sure where to post this question, so I'm trying
> here.......
>
> I've inherited a small network. W2k server and several pc's running
> WP10 and WP11...
> I noticed that all users on the network were given Administrative
> rights (at the domain level, all users are part of the administrator
> grp Domain Administrators)
> I don't think this is such a great idea, so I want to remove them
> from this grp so they are members only of the Domain Users grp--This
> is the standard way a network is setup, I believe.....

Absolutely!!!
>
> You probably know that a member of the domain administrators grp by
> default is given administrator rights to the local XP computer they
> are logged into. So, right now, they are administrators of the local
> pc as well as the network.
>
> My problem is this. When I remove them from the domain administrators
> grp, WP does not work correctly,e.g.-there are certain functions that
> no longer work (spell check for one) When I put them back into the
> Admin grp, then everything works again.....

If absolutely necessary, you can add Domain Users to the local
administrators group on each computer. Maybe do that right now, and then
when you have more time, troubleshoot the WP issue - maybe check their
support site to figure out what they need right to. Would PowerUsers do it?
Etc etc etc.

>
> there must be a rights issue then on the local machine......?
>
> But why? A standard network user does not have domain admin
> rights........

Absolutely true.

> No doubt, WP was installed by a user with domain
> rights, but still, why is it needing admin rights to operate?

Because it's written badly? That's the usual culprit. Still, as mentioned
above, if they have *local* admin rights, it ought to work - domain admin is
WAAAAY overkill and a bad idea.

> What can I do to fix it?
> Where should I even start to look?
> My next step when next Im there, is to add the network user as a user
> on the local machine with admin rights (this will make him a admin
> for the local PC, but not for the network) and see what this
> does.........
>
> I suspect that things will then work correctly again, but that is not
> a solution...

Agreed. But it will buy you some time.
>
>
> Any insights or comments, or outright solutions would be greatly
> appreaciated..
>
> If anyone knows of a better place to ask this question, I would
> appreaciate that info too.....
>
> I'm grasping at straws,,, ANY thoughts.....



Relevant Pages

  • Re: New Organizational Unit for a new remote office.
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... EVERY DOMAIN ADMIN IN THE FOREST ...
    (microsoft.public.win2000.active_directory)
  • Re: Granting all users Admin Rights
    ... I am a Network Admin for Cuesta College and we are dealing with the same ... Techs to go to install every little piece of software on users computers. ... I believe that giving users Power Users rights is the best way ...
    (microsoft.public.win2000.security)
  • Re: Impact of removing administrative rights in an enterprise running XP
    ... the network admin is "Admin" of the network... ... they should only have/need the appropriate rights for their role in the firm. ... reporting mechanisms for software/patch installations whatsoever. ...
    (Focus-Microsoft)
  • Re: Printer Problems
    ... he had the user rights to disable ... (default install behavior on xp), and it failed because DeskJet needs it ... If you create another admin on that system, you could see the problem again, ... > I manage a small network at a downtown Denver hotel. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: New Organizational Unit for a new remote office.
    ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... * This posting is provided "AS IS" with no warranties and confers no rights! ... EVERY DOMAIN ADMIN IN THE FOREST ...
    (microsoft.public.win2000.active_directory)

Loading