Re: Client Setup Wizard Error

I guess my point is this then. I don't want my users to have local admin
rights. I have no problem initially having admin rights to set them up, but
after that, it's back to the users group. However, not having local admin
rights causes the error I desccribed earlier to occur. I know I can simply
tick the box to not show the message again, but I'm wondering why I'm getting
the message in the first place. Is it that unless your users are local
admins, you will always get this message on any SBS installation or is there
something up on my setup.



"Merv Porter [SBS-MVP]" wrote:

If you use the ConnectComputer wizard to join the workstation to the domain
and set up the local (peer-to-peer) users as domain users, those local users
are automatically made members of the local administrators group after
joining the domain. You can leave them this way or reduce their permissions
for added security.

After joining domain, Users have become local admins
http://groups.google.com/group/microsoft.public.windows.server.sbs/browse_thread/thread/cb0f073c36c9ba36/2a56987c19e7871b?lnk=st&q=connectcomputer+all+users+local+admin&rnum=18&hl=en#2a56987c19e7871b

If you manullay join the workstations to the domain, you must manually
elevate the permissions of all domain users of that workstation to "local
administrator" status to get them set up properly. Then they can be
downgraded.

--
Merv Porter [SBS-MWP]
============================

"GaileForce" <GaileForce@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:C1C534D4-B9EC-474A-99D7-3D6E97BA1791@xxxxxxxxxxxxxxxx
Thanks Merv.

Is this a work-a-round or the way it is suppossed to be in all SBS
installations? I understood that this can be used to deliver
applications.
How can that work unless all users are Local Administrators at all times?

I appreciate you can stop the message from being displayed using the
checkbox, but I'm concerned that something is not working properly.


"Merv Porter [SBS-MVP]" wrote:

The initial setup of the user should be done as a local admin. After
that,
log him out, then remove him for the local admin group on the
workstation.
On subsequent logins he will get the "You must be a member of the local
administrators security group..." message, which he can dismiss
permanently
by checkmarking the "Do Not Show Again" box in the message.

--
Merv Porter [SBS-MWP]
============================


"GaileForce" <GaileForce@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:BF4E3A92-3CBB-4FA2-BB1B-49482AB8D0FF@xxxxxxxxxxxxxxxx
Hi,

Can someone please confirm something for me. When running a SBS2003
network, do all users logging on to the clients need to be local
administrators in order for the SBS_Login_script.bat and the
<server>\clients\setup\setup.exe /s <Server> call to work. I have one
new
user that whenever they log on, they get a "You must be a member of the
local
administrators security group on this computer to install and configure
applications. Contact your network administrator".

I have seen various posts with a similar error and people have
suggested
"Trying" a local administrator option. However I wonder is this is a
requirement that all users must be local administrators in SBS2003.

Thanks in advance.







.

Relevant Pages

  • RE: Correct setup of XP-Pro computer on Win2K Domain
    ... Setting up a local account on the xp machine does not result in local admin ... rights for that user, you need to put them in the local admin group. ... > inconsistent problems with security when I setup a new XP-Pro workstation. ...
    (microsoft.public.windowsxp.setup_deployment)
  • Re: Adding a NT global group for local admin rights
    ... workstation and add the group to the administrators group on the local ... add itself to the local admin group. ... group to the admin group on the workstation. ... > admin rights. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Local Admin
    ... button you don't get the option for the local admin group. ... of just being able to do it for the one machines local ... >users or groups that need to be local administrators on ... >> control at my workplace. ...
    (microsoft.public.win2000.security)
  • Re: Local PC Admin Group change - Alerts
    ... "Administrators" group of a PC that is attached to the domain. ... is about local admin / power user groups within individual PCs connected ... Local Admin group change, it would be feasible. ... those rights and no one else. ...
    (Security-Basics)
  • Re: Help needed setting up roaming administrator
    ... Administrators on one workstation. ... On the other hand, if I'm logged in as a local admin, I ... >> can't access any of the DOMAIN user accounts. ...
    (microsoft.public.win2000.security)