power users on win2k wrkstation and gpo

  • Thread starter Thread starter Jason
  • Start date Start date
J

Jason

I have a very limited understanding of domain and domain controller level
group policy. I have implimentated a variety of policies; however many
fundamentals apperently still escape me. I want to grant users the rights
that correspond to the local right on a machine equivalent to the "Power
User" rights. I want to do this using gp. How do i accomplish this? Having
failed to grasp this capability i have added the user(s) to the local power
user group. Please point me in the right direction. thanks in advance for
your help.
 
Unfortunately that is about all you can do. The local groups on a
workstation (or server for that matter) grant rights and abilities
that
can not be fully duplicated by a Group Policy.

You can use a Group Policy to add domain users to the local
Power Users group which should lessen the administration needed.

Here are the steps to accomplish this:

Run the group policy snap-in and choose the Default Domain Policy.
Go to Computer Configuration \Windows Settings\Security
Settings\Restricted Groups

Right Click and Choose to add a group - then type in Power Users.

Next add in the users or groups you want added to power users and add
them to the " Members of this group "


Once you close the snap-in and open it back up you will see that it
no longer displays the name Power Users but instead shows the SID
S-1-5-32.547. This is not a problem and can not be changed it is the
SID for the Power Users Group.


This process has two draw backs - When looking at the Restricted
Groups the Power Users show up as a SID and you will log Event 1000
with a source of userenv and a 1202 event with a source of SceCli in
your event log on the DC every time group policy is applied.

Also be aware that this will remove any current members of the group
and replace them with the users you have specified in the policy.



Tom Ausburne (MSFT)
Windows 2000 Directory Services
This posting is provided "AS IS" with no warranties, and confers no
rights.
 
Back
Top