Lara,
just a couple of comments in-line........
--
Cary W. Shultz
Roanoke, VA 24014
Microsoft Active Directory MVP
http://www.activedirectory-win2000.com
http://www.grouppolicy-win2000.com
lforbes said:
Hi,
Yes, I do it all the time. Create the Users Domain Accounts as regular
users. After adding the workstation to the Domain go to the Computer
Management - Users and add the Users Domain Account to the local
administrators group on the local workstation. Computer management
can be done remotely once workstation is joined to a domain so you
don't have to be sitting at the machine.
Just as a general piece of advice, I never never never promote adding the
regular domain user account objects to the local computer's Administrator
group. This allows the domain user account object to have access to
everythign and anything. I can tell you war stories about idiots ( and I
specifically used that term ) who deleted all of the files from the
c:\winnt\fonts folder so that they could make more room for the music files
or so that they could add their own fonts ( she did not want to be confussed
as to what fonts she added so she just deleted them all and then added hers
to the fonts folder ). Or how people will install all of this Spyware
crappola ( such as the Time Precision or Hotbar or Weatherbug or..... ). Or
the registry edits that they make! Can not tell you how many computers I
have had to wipe and load because of this ( worked in the Entertainment
Industry so there was no time to really fix things.... ). And of course
very few people will admit to doing anything...."It just started doing
this!" is what I usualy was told.
There are some older ( and newer ) software applications that require that
the user account object being used to install the software has
Administrative privileges during the installation. Bad! I typically use
Filemon and Regmon from
http://www.sysinternals.com to find out exactly what
keys and / or directories are causing the problems. Then you can change
that / those.
Generally, this is a really bad idea....especially in a large environment.
I took care of some 300 users - essentially by myself - and you can waste a
lot of time trying to figure out what these knuckleheads have done (
specifically those that will not admit to anything.... ).
Just my stance on this topic....Does not make it right or wrong or yours
right or wrong. I would just simply - behind the scenes - fight tooth and
nail against this. Well, to a point! Power Users would be more acceptable.
But that all depends!
And adding the user account object to the local computer's Administrator
group should have no bearing whatsoever on remote Administration of said
computer account object. This is possible already.......Domain Admins =
local Administrator.....
Actually they are a workstation in the domain, just like NT. A Member
server is actually Windows 2000/03 server joined to the domain but not
as a DC.
Correct! But, I *think* that Brian was talking about the way that a
workstation is added to the domain. It is the same procedure as a Member
Server. And, Brian could also have meant that the userAccountControl value
is 4096......
Check out my website to make sure you setup DNS correctly. Also when
creating the Domain name, it is recommended to use the .local
extension instead of a public one like .com or .net.
While there are many who would support this approach, I am not so sure that
there is a problem using 'yourdomain.com' as your internal namespace as well
as your extrernal name ( the so-called Split Brain configuration ). Just
about everywhere I have worked has had this type of set up. And, if you
use MACs, using the .local extension is supposed to cause a lot of grieve
for the MACs. Not sure as I have never worked in a .local environment where
there were MACs......
