Re: More user rights needed

I did logged on with a user under domain admin group.
But the "Add" to the group button is dimmed.

May be the the group policy at domain level already blocked this action.

Anyway, thanks for your explanation.


"Doug Sherman [MVP]" <dsherman@xxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:uxEdhArSGHA.5496@xxxxxxxxxxxxxxxxxxxxxxx
If you are going to do this on a client machine, you must be logged on as
a
member of the local administrator's group. By default a member of the
domain admins group is a member of the local administrators group on all
clients joined to the domain.

Doug Sherman
MCSE, MCSA, MCP+I, MVP

"Darren Hughes" <dhughes@xxxxxxxxx> wrote in message
news:#riqllqSGHA.4300@xxxxxxxxxxxxxxxxxxxxxxx
Thanks Brian,

I did try to add the domain user into the administrator group at the
client
machine.
However, the local PC didn't let me do it. It seems that I can modify the
policy on the client machine.

Can you give me a simple example of creating the restrict group?
I'm confused by the detailed description. I afraid I do the reverse way.

The following is my user structure in one of the OU.

Staff (OU)

darren, user1, user2, user3 (Users)

Admin, Account, IT (security group)

All the user are members of domain user only, where darren, is also a
member
of domain admin.



thanks.

Darren


"Brian Delaney" <BrianDelaney@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:711DC31B-4976-496A-9E39-727F26E06EF1@xxxxxxxxxxxxxxxx
If you wish to grant your users access to install/uninstall programs
you
need
to grant them with local administrative rights on their PCs.

You can do this manually via Computer Management --> Local Users and
Groups
--> Groups --> Administrators and add the desired Domain Users into
that
group.

Or you can do this through a group policy by configuring Restricted
Groups
and this will get pushed down to the client machines (becareful not to
configure this at domain level for this purpose as this would also
affect
the
Administrators group for the domain)

http://technet2.microsoft.com/WindowsServer/en/Library/2715d832-fe71-47f7-86
fd-412f013a40cd1033.mspx

--
Brian Delaney, MCSE


"Darren Hughes" wrote:

We have a brand new 2003 server installed. Before, we don't have any
server
and users work as a workgroup.

After users join the new domain. Most of the program can't run.
The users can't install or uninstall any program or updates.

Is there any way to grant the sufficient right for them to install and
run
programs?

I think the default policy is too restricted.

Thanks.

Darren.









.