Re: Remove the "Domain Users" group from the "Power Users" group..

From: Iikka Meriläinen (Iikka.Merilainen@pato.vaala.fi)
Date: 11/30/02 

From: "Iikka Meriläinen" <Iikka.Merilainen@pato.vaala.fi>
Date: Sat, 30 Nov 2002 23:22:54 +0200

Hi!

You can do some testing on a single workstation, but I don't understand why
Domain Users should be members of Power Users at all. It's a risk. If the
users don't require any special privileges during their daily use of those
workstations, they certainly don't have to be Power Users. 

--
Best regards,
Iikka Meriläinen
Vaala, Finland
==================================================
Please reply to the newsgroup only so that others can learn from this issue.
This message is provided "as is", with absolutely no warranties.
==================================================
"Netmasker" <netmasker@yahoo.com> wrote in message
news:asata7$c7a$1@nic.grnet.gr...
> In my windows 2000 SP3 workstations I noticed that "Power Users" group
> include (has as member) "Domain Users" group. This mean that the domain
> users that log in to the workstations have Power Users rights, doesn' t
it?
> I would like my domain users to have only "Read & Execute Access" on
folders
> like
> 'Program files', 'Winnt' etc. so they will not be able to install programs
> or hide files in these folders. But Power Users have "write access" on
these
> folders and that's the problem.
> How safe is it to remove the "Domain Users" group from the "Power Users"
> group membership ??
>
> thanks in advance.
>
>
>
>
>
>
>

Relevant Pages

  • Setting local machine permissions via GPO
    ... We need to set all our domain users up as power users on the local ... workstations; we've thought through the implications of this but we have ... the power users group. ...
    (microsoft.public.win2000.security)
  • Re: Disable logon to XP without disabling or locking account?
    ... Administrators group on all our workstations. ... Note that Power Users is pretty nearly Administrators in XP - I'd rethink ... account for Run As... ... Pretty soon a couple of domain users have read the batch files and ...
    (microsoft.public.windowsxp.security_admin)
  • GPO - adding Domain Users to local Power Users group
    ... Domain Users? ... Members of this Group and This Group is a Member of. ... where I can choose Power Users in any of those options. ... Can someone please reveal this well kept secret? ...
    (microsoft.public.win2000.active_directory)
  • GPO - adding Domain Users to local Power Users group
    ... Domain Users? ... Members of this Group and This Group is a Member of. ... where I can choose Power Users in any of those options. ... Can someone please reveal this well kept secret? ...
    (microsoft.public.windows.server.active_directory)
  • Disable logon to XP without disabling or locking account?
    ... Administrators group on all our workstations. ... and things that Power Users cannot. ... account for Run As... ... Pretty soon a couple of domain users have read the batch files and ...
    (microsoft.public.windowsxp.security_admin)