Re: Shutdown/Removed Power User rights from desktop

From: Cindy (Cindy_at_discussions.microsoft.com)
Date: 04/08/05 

Date: Fri, 8 Apr 2005 10:47:02 -0700

YES, YES, YES, IT WORKS NOW......The settings was in the Default Domain
Controller Policy, Computer Configuration, Windows Settings, Security
Settings, Local Policies, User Rights Assignment, Shutdown the system. I
have to mention though that the Power User group was not in here, but I do
see an entry for *S-1-5-32-547.

Thanks again for all your help.

Cindy

"Steven L Umbach" wrote:

> You should still be able to read the effective policy even if it is grayed
> out to see if users are included but at least you know you have an
> overriding policy applying from somewhere. You will need to run support
> tools from the folder where they are installed or specify the full path to
> them. If a security policy setting is undefined it may have been define at
> one time. You could try defining it with all the groups that you need to
> have that user right. Then run secedit /refreshpolicy machine_policy
> /enforce first on the domain controller and then on the client computer to
> see if that changes effective policy. If that does not help you need to find
> what Group Policies/computer configuration are being applied to those
> computers and reconfigure the policy that is being applied to the computers
> at that level. Gpresult will show you something like below which I ran on my
> computer for applied Group Policy objects. --- Steve
>
> COMPUTER SETTINGS
> ------------------
> CN=STEVE-XP,CN=Computers,DC=umbach1,DC=com
> Last time Group Policy was applied: 4/7/2005 at 1:25:14 PM
> Group Policy was applied from: server1-2000.umbach1.com
> Group Policy slow link threshold: 500 kbps
>
> Applied Group Policy Objects
> -----------------------------
> Default Domain Policy
> Local Group Policy
>
>
> "Cindy" <Cindy@discussions.microsoft.com> wrote in message
> news:05EEC180-1F79-4E4D-9530-EBB602747D15@microsoft.com...
> > Thanks, Steve. The Local Security Policy indicates that users have this
> > right, but the effective policy is "greyed out", does that mean the
> > effective
> > policy is coming from the Doman Security Policy. I opened the "DMS" and
> > the
> > status was not defined, so I added both Administrators and Domain Users.
> > I
> > have the support tools installed but can not find gpresult. Where do I
> > get
> > this?
> >
> > Cindy
> >
> > "Steven L Umbach" wrote:
> >
> >> Normally users can shutdown their computers. Possibly this was changed in
> >> domain policy. On one of those computer open Local Security Policy
> >> [secpol.msc] and go to security settings/local policies/user rights and
> >> look
> >> at the "effective" setting for the user right for "shut down the system".
> >> If
> >> the users group is not present you can add it. You would want to do such
> >> at
> >> the domain or Organizational Unit Level where that security policy is
> >> defined. The support tool gpresult will show what computer configuration
> >> group policies are applying to the computer. It would be best to define
> >> it
> >> in the policy "closest" to the computer such at the OU level GPO if one
> >> is
> >> used. Otherwise it probably is defined in Domain Security Policy. ---
> >> Steve
> >>
> >>
> >> "Cindy" <Cindy@discussions.microsoft.com> wrote in message
> >> news:6A0613D4-D7CA-4466-A7FD-159247411AFB@microsoft.com...
> >> >I have removed users from the power user group and now they belong to
> >> >the
> >> > Domain User group on the desktops. Now they have to logoff before the
> >> > shutdown option is available. Where do I change this setting back to
> >> > allow a
> >> > Shutdown, Restart or Logoff option or is this available only if you are
> >> > a
> >> > member of the Power User group.
> >> >
> >> > Thanks in advance
> >> >
> >> > Cindy
> >> >
> >> >
> >> >
> >>
> >>
> >>
>
>
>

Relevant Pages

  • Re: scripted logon
    ... Why can't you launch all the scripts from a Group Policy based Logon script. ... Here's the policy settings (I sure hope word wrap doesn't mess it up too ... Windows Components/Windows Installer ...
    (microsoft.public.windows.terminal_services)
  • Re: GPO Update Problem (SYSVOL access via UNC)
    ... Server Security and Auditing Policy ... This list only includes links in the domain of the GPO. ... The settings in this GPO can only apply to the following groups, users, ...
    (microsoft.public.win2000.group_policy)
  • Re: GPO Update Problem (SYSVOL access via UNC)
    ... > Server Security and Auditing Policy ... > This list only includes links in the domain of the GPO. ... > The settings in this GPO can only apply to the following groups, users, ...
    (microsoft.public.win2000.group_policy)
  • Re: GPO Update Problem (SYSVOL access via UNC)
    ... >> Server Security and Auditing Policy ... >> The settings in this GPO can only apply to the following groups, users, ... >> Windows Firewall: Allow file and printer sharing exception Enabled ...
    (microsoft.public.win2000.group_policy)
  • Re: GP settings questions?
    ... I made a domain policy and all settings took ... Administering Group Policy by Using the Group Policy ... This newsgroup only focuses on SBS technical issues. ... you may want to contact Microsoft CSS directly. ...
    (microsoft.public.windows.server.sbs)