There is no power users group at the domain level, but that is a group on the
local computer [other that domain controller] that has many administrative
powers such as creating non administrative accounts, installing software, and
creating shares. A domain user can be a member of the power users group on a
domain machine. The administrator is the built in administrator account for the
domain that has a unique sid and the account can not be locked out ever from
interactive logon, removed from the administrators group, or disabled [in W2K].
The domain admins is a global group that belongs to the administrators group for
the domain as does the administrator. A user added to the domain admins group
will be all powerful in the domain like the built in administrator account and
also be a local administrator on all domain machines by default. However any
user other than the built in administrator can be locked, disabled, or removed
from the administrators group. See link below for more info on groups. ---
Steve
http://www.microsoft.com/technet/tr.../security/topics/issues/w2kccscg/w2kscgcd.asp
Ricardo said:
What is the main difference between the groups "Administrator" ,Domain
administrators and "Power Users" rights in a domain ?