Announcement

Collapse
No announcement yet.

editing user rights on domain

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • editing user rights on domain

    How do i edit user rights on 2003 server to allow user to run a specific program.

    in workgroup to run that program power user privileges were given.
    but i don't want every user 'server operators' previleges in domain.

    i dont want to allow any power rights but just that program should run.

    any options??
    Last edited by harrymiller; 23rd November 2006, 22:26.

  • #2
    Re: editing user rights on domain

    got answer to it
    http://support.microsoft.com/default...;EN-US;Q320065

    anyone got diff idea...like more specific: to run certain progs?not giving complete POWER access
    Last edited by harrymiller; 23rd November 2006, 22:28.

    Comment


    • #3
      Re: editing user rights on domain

      "Power User" is nothing special to be honest... it just gives you the right to manage printers and install devices - along with a couple of other bits which are not as important if I remember rightly. Now you're in a domain, you could make the "Domain Users" group a member of the "Power Users" group on the workstations... that should work quite nicely.

      It's possible to do this via login script and possibly by Group Policy - not sure about that last however.


      Tom
      For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

      Anything you say will be misquoted and used against you

      Comment


      • #4
        Re: editing user rights on domain

        Sorry, but I don't exactly understand the question, maybe you can clarify: the users login to the server somehow? Terminal Services? Directly on the console? Or the application just sits on a network share and the users have to run it from their workstations?

        TIA.

        Sorin Solomon


        In order to succeed, your desire for success should be greater than your fear of failure.
        -

        Comment


        • #5
          Re: editing user rights on domain

          >Now you're in a domain, you could make the "Domain Users" group a member of the "Power Users" group on the workstations... that should work quite nicely.


          the users just need to load power user right on their systems.the program is on individual workstations.


          got the solution.

          Just login to workstation as administrator.
          Go to users on control panel.
          there you can add power user rights to the domain user on that pc !!

          thanks guys.

          Comment


          • #6
            Re: editing user rights on domain

            Originally posted by harrymiller View Post
            >Now you're in a domain, you could make the "Domain Users" group a member of the "Power Users" group on the workstations... that should work quite nicely.


            the users just need to load power user right on their systems.the program is on individual workstations.


            got the solution.

            Just login to workstation as administrator.
            Go to users on control panel.
            there you can add power user rights to the domain user on that pc !!

            thanks guys.
            Exactly what I said; but instead of adding the user by name I said to add the "Domain Users" group; that way ANY user who logs on has the correct rights...


            Tom
            For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

            Anything you say will be misquoted and used against you

            Comment


            • #7
              Re: editing user rights on domain

              Originally posted by harrymiller View Post
              got the solution.

              Just login to workstation as administrator.
              Go to users on control panel.
              there you can add power user rights to the domain user on that pc !!
              Sounds tedious to me. You can use Restricted Groups like it says in the KB you posted and that would allow you to have easier control and less administrative overhead.

              Also, IMHO, having every user be a member of the Power Users group is not a good idea. It will enabled them to install/remove programs and add local users. Both of which are huge security risks.

              I would take the time to find out what registry keys and file directories they need modify access on and just change them to have the appropriate permissions. You can also deploy these settings through Group Policy.
              Regards,
              Jeremy

              Network Consultant/Engineer
              Baltimore - Washington area and beyond
              www.gma-cpa.com

              Comment


              • #8
                Re: editing user rights on domain

                Originally posted by JeremyW View Post
                Also, IMHO, having every user be a member of the Power Users group is not a good idea. It will enabled them to install/remove programs and add local users. Both of which are huge security risks.
                Are you sure about this? We have a large set of users as power users in my work place, and while they can install some programs, they can't install any and all programs (don't know why one program and not another though). I know they definitely cannot add local users however.
                ** Remember to give credit where credit is due and leave reputation points where appropriate **

                Comment


                • #9
                  Re: editing user rights on domain

                  AFAICR you need to be "Account Operator" or above to have user management rights by default. (i.e. to create local accounts). Power users have access to the clock and can install printer drivers; they also have the right to install some apps.


                  Tom
                  For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

                  Anything you say will be misquoted and used against you

                  Comment


                  • #10
                    Re: editing user rights on domain

                    Power Users

                    The Power Users group primarily provides backward compatibility for running non-certified applications. The default permissions that are allotted to this group allow this group's members to modify computerwide settings. If non-certified applications must be supported, then end users will need to be part of the Power Users group.

                    Members of the Power Users group have more permissions than members of the Users group and fewer than members of the Administrators group. Power Users can perform any operating system task except tasks reserved for the Administrators group. The default Windows 2000 and Windows XP Professional security settings for Power Users are very similar to the default security settings for Users in Windows NT 4.0. Any program that a user can run in Windows NT 4.0, a Power User can run in Windows 2000 or Windows XP Professional.

                    Power Users can:

                    Run legacy applications, in addition to Windows 2000 or Windows XP Professional certified applications.

                    Install programs that do not modify operating system files or install system services.

                    Customize systemwide resources including printers, date, time, power options, and other Control Panel resources.

                    Create and manage local user accounts and groups.

                    Stop and start system services which are not started by default.


                    Power Users do not have permission to add themselves to the Administrators group. Power Users do not have access to the data of other users on an NTFS volume, unless those users grant them permission.
                    From http://www.microsoft.com/resources/d....mspx?mfr=true
                    Regards,
                    Jeremy

                    Network Consultant/Engineer
                    Baltimore - Washington area and beyond
                    www.gma-cpa.com

                    Comment


                    • #11
                      Re: editing user rights on domain

                      *shrug*

                      Fair enough - my bad


                      Tom
                      For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

                      Anything you say will be misquoted and used against you

                      Comment


                      • #12
                        Re: editing user rights on domain

                        Every day is a chance to learn
                        Regards,
                        Jeremy

                        Network Consultant/Engineer
                        Baltimore - Washington area and beyond
                        www.gma-cpa.com

                        Comment

                        Working...
                        X