Re: Remove the "Domain Users" group from the "Power Users" group..

From: Jerold Schulman (Jerry@jsiinc.com)
Date: 12/01/02 

From: Jerold Schulman <Jerry@jsiinc.com>
Date: Sun, 01 Dec 2002 10:46:51 -0500

On Sat, 30 Nov 2002 19:42:01 +0200, "Netmasker" <netmasker@yahoo.com> wrote:

>In my windows 2000 SP3 workstations I noticed that "Power Users" group
>include (has as member) "Domain Users" group. This mean that the domain
>users that log in to the workstations have Power Users rights, doesn' t it?
>I would like my domain users to have only "Read & Execute Access" on folders
>like
>'Program files', 'Winnt' etc. so they will not be able to install programs
>or hide files in these folders. But Power Users have "write access" on these
>folders and that's the problem.
>How safe is it to remove the "Domain Users" group from the "Power Users"
>group membership ??
>
>thanks in advance.
>
>
You can remove it.
To do that via the command line:

net localgroup "Power Users" "Domain Users" /delete

Jerold Schulman
Windows Server MVP / Configuration Management
JSI, Inc.
http://www.jsiinc.com

Relevant Pages

  • Re: Share Folder Permission on xp in a 2003 domain
    ... If you really really need your users to be power users I'd choose to ... use restricted groups to make Domain Users member of the local Power ... > create permenant shared objects ...
    (microsoft.public.win2000.active_directory)
  • Re: Power User Setting Not Saved
    ... when I say "local user" I mean the login name that is typically used ... user that is a member of that OU then be a Power User? ... There are two ways to do Restricted Groups - members of this group or this ... membership of the Restricted Group [power users in your case] will be ...
    (microsoft.public.windowsxp.security_admin)
  • Re: User rights assignment in XP Pro
    ... > So why not use the MMC to get true control of the user accounts? ... Now it says Fred is a member of "Power Users". ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Disabling sharing tab in client systems
    ... removing them from the power users or administrators group and making sure ... that they are only regular users. ... member of a domain group that is a member of the local administrators or ... power users group on his computer. ...
    (microsoft.public.windows.server.security)
  • Re: Power User Setting Not Saved
    ... included in the Restricted Group via this group is a member of. ... power users along with the specific user you added. ... Restricted Groups to speed up propagation of any changes first run gpupdate ... move it to an Organizational Unit that would not have that Group Policy ...
    (microsoft.public.windowsxp.security_admin)