Setting User Rights for my INtern

  • Thread starter Thread starter Karthik Param
  • Start date Start date
K

Karthik Param

HI All

I have a new Intern in my office. I want to setup him an
user account in my domain. I don't want to give him any
domain admin status immediately.
I have set up a group policy for all my users so that they
will not be able to install any softwares, they cannot see
th control panel, network places.

I want to give my intern the ability to go and download
software updates and install any new drivers, trouble
shoot any hardware problems.
I have created him an user account in my Active Directory.
IN the Properties page I went to the 'Members of' tab and
added him to the 'Power Groups'. Still my intern is not
having acces to install any updates.
Kindly let me know how you can set up an account with that
privelleges without having to giving more permissions then
what he supposed to have.

thank you

Karthik param
 
All you have to do is give him/her local admin rights on
the workstation, either by adding another domain group to
all your workstations and making him/her a member of that
group (local groups on the workstation can be populated
with a GPO or Startup script)or giving him/her the local
administrator password.
For AD I would create a global group, assign that group
the rights needed in AD such as, create user/delete user,
create OU/delete OU, change password...ect. To keep the
GPO from affecting the INTERNs deny the global group the
apply GPO right in the GPO security tab. Then make the
person a member of that group(can also be the same group
you add to all your local WKS admin group).
When the INTERN changes all you have to do is change
group membership. All the work you put in createing the
security for your interns will still exist on the group
and can be modifyed and reused.
 
HI

Thank you for the Info. I am not able to understand fully.
Can u walk me through step by step.

thank u in advance
 
Karthik Param said:
HI All

I have a new Intern in my office. I want to setup him an
user account in my domain. I don't want to give him any
domain admin status immediately.
I have set up a group policy for all my users so that they
will not be able to install any softwares, they cannot see
th control panel, network places.

I want to give my intern the ability to go and download
software updates and install any new drivers, trouble
shoot any hardware problems.
I have created him an user account in my Active Directory.
IN the Properties page I went to the 'Members of' tab and
added him to the 'Power Groups'. Still my intern is not
having acces to install any updates.
Kindly let me know how you can set up an account with that
privelleges without having to giving more permissions then
what he supposed to have.

thank you

Karthik param
Click to expand...


You'd have to place the user outside of the Group Policy. Either put
him in the OU where your account is or in a sub OU and deny policy
inheritance. Putting him in the "Power Groups" has no effect on the AD
Group Policy which denies access to control panel and such.
 
Back
Top