Help! How do I see what OS management rights a Group has?

gretzkygirl44_at_yahoo.com
Date: 05/23/05 

Date: 23 May 2005 13:43:21 -0700

 Hi,
I am trying to figure out how I can see what rights a specific group
has in an active directory domain. Not what rights the group has to a
file system but what OS rights they have.

I am taking over management of a domain that I didn't build. It is a
windows 2000 domain with active directory (I have previously only
managed NT domains). There are several users put into several different
groups. HelpDesk, Assistants, CallCenter, etc, etc. I am trying to go
back and document what rights HelpDesk and the other groups were
assigned at creation. I thought most rights would be assignsed from
'local security settings' but I don't see the information I am looking
for in there. For example, I know users in 'Help Desk' can reset/change
passwords from testing with their IDs (and help desk isn't part of a
built in like account operators). Is there somewhere in a gui or a
command line option to list all rights a group was given at creation?

If I click on the group properties I only see, members, members of,
etc.

Thanks for any advice!
M

Relevant Pages

  • Re: Basic Authentication + IIS 5 + Windows 2000 + Frontpage 2002 = failure?
    ... Authentication" story and can relate to them all. ... the introduction of Active Directory. ... All rights ... > | Vincent Polite ...
    (microsoft.public.inetserver.iis.security)
  • Re: Basic Authentication + IIS 5 + Windows 2000 + Frontpage 2002 = failure?
    ... Authentication" story and can relate to them all. ... the introduction of Active Directory. ... All rights ... > | Vincent Polite ...
    (microsoft.public.inetserver.iis.security)
  • Re: ADAM Synchronizer Beta - question
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... >> Right is not granted to the account that is used to connect to AD. ... >> Dmitri Gavrilov ... >> SDE, Active Directory Core ...
    (microsoft.public.windows.server.active_directory)
  • Re: Error 4913: SMS cannot create the object in AD
    ... Does the service account have all rights to all child objects? ... Active Directory Schema Modification and Publishing for Systems Management ... Check out the SMS Technical FAQ: ... This posting is provided AS IS with no warranties and confers no rights. ...
    (microsoft.public.sms.admin)
  • Re: Moving DCs From Default OU ?
    ... You cannot protect against this in any way you dream up because it just cannot be done with Active Directory. ... You might as well make them Domain and Enterprise Admins, at least you will be honest with yourself them on what rights they have. ... Again, I don't care who told you otherwise, you cannot protect the AD from someone you give admin level rights or in fact even server operator rights or even less. ... In almost every case it the thought to do this is based on some misunderstanding on how Domain Security works or some stupid plan to have a pretty hierarchy. ...
    (microsoft.public.windows.server.active_directory)