Re: Is every user a member of Users?

From: Les Desser (NewsDump1_at_dessergroup.com)
Date: 01/04/05

  • Next message: Steven L Umbach: "Re: Is every user a member of Users?" 
    Date: Tue, 4 Jan 2005 01:44:00 +0000

    In article <x5mCd.20234$wu4.14984@attbi_s52>, Steven L Umbach
    <n9rou@n0-spam-for-me-comcast.net> Tue, 4 Jan 2005 01:14:05 writes

    >Yes. Anyone who logs on locally for instance is a member of the
    >authenticated users group which is a member of the users group. Use the
    >" net localgroup users " to see that and use the gpresult support tool
    >to see all the groups that a user is a member of.

    At least that makes a bit more sense - see below

    > Always be extremely carefully when configuring deny user rights when
    >adding the users or everyone groups. Exactly what are you trying to
    >secure?

    I was trying to secure a stand alone W2K Pro PC so that a guest could
    browse the web and play some mp3 files but nothing else.

    I created a Visitors group and a Visitor user to be its member (rather
    then using Gusts/Guest) and Visitor was not a member of Users and
    nevertheless Visitor could go anywhere until I removed all permissions
    for Users.

    I cannot understand having such a security model where Users/User exist
    and are granted permissions by default, but if membership of Users is
    removed from a user it is STILL a member of Users.

    If Users is something special then it should not be possible to assign a
    user explicitly to the Users group - something that is done all over the
    place by default.

    You live and learn - thanks for the quick response. I see bringing
    knowledge of a security model from elsewhere to Windows may be
    dangerous.

    I will pass your response on grc.techtalk where I have come from to get
    this sorted.

    Thanks again. 

    -- 
Les Desser
(The Reply-to address IS valid)
  • Next message: Steven L Umbach: "Re: Is every user a member of Users?"

    Relevant Pages

    • Re: Protecting the All Users Start Menu
      ... domain user account objects are members of the local Power Users group. ... I am sure that you know, the Domain Users is, by default, a member of the ... that the user be a member of the local Administrators group. ...
      (microsoft.public.win2000.active_directory)
    • Re: Local Users Group - Safefly removing users ?
      ... what remains in the Users group. ... if only locally defined non-guest accounts ... no. Denying local login is done with the Deny login locally user right. ... Notice that I have a few times qualified with "member" by which I have ...
      (microsoft.public.security)
    • Re: Special privileges assigned to new logon??
      ... I assure you that the limited advice ... Why are they a member of the Power Users group? ... I'm looking through the event log for successful logon or logoff ...
      (microsoft.public.security)
    • Re: Enable file and folder sharing for the Users Group
      ... >>Log on as an administrator, ... > I want to enable the file and folder sharing for the members of the users ... member of power users. ... users group. ...
      (microsoft.public.win2000.networking)
    • Re: XP slow name resolution
      ... >I have a problem whereby when a user who is not a member of the local ... > Log on as a member of the built in users group only and you can ping ... > IP with an instant response however when you ping via hostname it sits ...
      (microsoft.public.windowsxp.general)