Re: User default permissions in Windows Server 2003

From: KD (KD_at_discussions.microsoft.com)
Date: 01/28/05 

Date: Fri, 28 Jan 2005 07:07:08 -0800

We haven't created a domain policy that modifies the members of the local
admins group. What happens is if we take a user who is just a domain user,
put them into a group with has local admin permissions, have them logout and
back in they do, indeed receive the elevated privleges. The issue is when we
remove this user from the group and they log back in, they still have those
elevated permissions.

"Bob Hollness" wrote:

> Have you created a domain policy which modifies the members of the local
> admins group? Or maybe a startup script for all computers?
>
> --
>
> Bob
>
> --------------------------------------
> I'll have a B please Bob.
>
> "Doug Sherman [MVP]" <dsherman@nospam.tampabay.rr.com> wrote in message
> news:e38rxzMBFHA.3528@tk2msftngp13.phx.gbl...
> > No, the default is that domain administrators are members of the local
> > administrators group and domain users are members of the local users
> > group.
> >
> > Doug Sherman
> > MCSE Win2k/NT4.0, MCSA, MCP+I, MVP
> >
> > "KD" <KD@discussions.microsoft.com> wrote in message
> > news:B4F7E7E5-DCD6-4474-9D11-DE2691AEDAD4@microsoft.com...
> >> Whenever I create a new user in our W2k3 domain, the user automatically
> > has
> >> admin rights to their local workstation. The user is a member of the
> > Domain
> >> Users Group ONLY.
> >>
> >> Is having local admin rights to their local workstation default?
> >>
> >> Thanks !!
> >> KD
> >
> >
>
>
>

Relevant Pages

  • Re: Guardian reports failing safety standards uncovered by Grayrigg enquiry
    ... I trust Bob Crow and his chums are doing their very best to assist the ... police in their investigations. ... course of an enquiry - and wouldn't instructing members not to ... In this case shouldn't the union be assisting in bringing forward ...
    (uk.railway)
  • Re: Domain and OU Permissions
    ... Use a VB script - you'll find examples on technet scriptcenter. ... vendor and ask them what privileges the account needs. ... of the Domain Admins group, then that's what you'll need to do - add the ... Only members of local administrators group can add other members to ...
    (microsoft.public.windows.server.active_directory)
  • Re: Run-time error 3033
    ... > only users who can change the value of the property, are members of the ... > Admins group of the workgroup file which was used to secure the ... > database ... > So I suggest that you log on as a member of the Admins group, ...
    (microsoft.public.access.security)
  • Re: Run-time error 3033
    ... only users who can change the value of the property, are members of the ... Admins group of the workgroup file which was used to secure the ... database ... So I suggest that you log on as a member of the Admins group, ...
    (microsoft.public.access.security)
  • Re: PETA
    ... > You are the one pointing the finger at them and their members, ... >> aid has PETA provided to actually do something for the birds and other ... >> Bob W ... >> Check out our web site, ...
    (rec.pets.birds)
Loading