Re: Default domain permissions

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 07/27/05 

Date: Wed, 27 Jul 2005 02:15:30 -0700

I do not believe there is such a document, and if so, then I would
question if it is up-to-date.

You say a normal user has those abilities, but you have not mentioned
the history of the environment, or whether you have considered all
groups in which the user holds membership.
The abilities you mentioned are things often delegated, and it sounds
as if the Users group may have been delegated those abilities. 

-- 
Roger Abell
Microsoft MVP (Windows  Security)
"ade" <someone@nowhere.com> wrote in message
news:OxkszDbkFHA.1204@TK2MSFTNGP12.phx.gbl...
> Hi all - posted this issue in win2000.active_directory a few days ago,
> wonder someone could help me?
>
> The OS is windows2000, single domain in native mode.
>
> When I log onto my machine (which has the admin tools installed) as a
normal
> user, I can modify/create/delete domain user accounts, and create new
GPO's.
>
> Things I have tried:
>
> Checking everyone group and domain user group permissions on the domain
and
> each OU.  Would appear that those groups have reset password and some
write
> permissions.  They are not members of domain admins/admins/enterprise
> admins.
>
> I have searched high and low for what the default domain user permissions
> should be but cannot locate a document with them on.  Could someone post
> them here please?
>
> Any help much appreciated.
>
>

Relevant Pages

  • Re: SHAREPOINT AND RWW ISSUES
    ... In WSS 2.0, when you create a Domain User account, the server adds it to SharePoint with 'Web Designer' rights. ... If you want to see or change these permissions for this group, go to 'Site Settings' / 'Go to Site Administration' / 'Manage Site Groups', click on 'Web Designer and then select 'Edit Site Group Permissions' ...
    (microsoft.public.windows.server.sbs)
  • Re: User Profiles
    ... the new hive to allow the domain user. ... In addition to the NTFS file permissions on the profile directories, ... are permissions contained in the registry hive stored in ntuser.dat (which ... New User Accounts May Not Be Permitted to Use User Profiles ...
    (microsoft.public.windows.server.active_directory)
  • Re: Adding PC to Domain. What really happens
    ... your domain user may have rights that your workgroup user ... * PLEASE post all messages and replies in the newsgroups ... > Registry, files, permissions, local GPO's. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Default domain permissions
    ... BTW - the user account in question is a member of domain users ONLY. ... >> Checking everyone group and domain user group permissions on ... >> I have searched high and low for what the default domain user ... > Visit Topic URL to contact author (reg. ...
    (microsoft.public.win2000.security)
  • Re: slow iis 6.0 performance
    ... Where could I get a list of permissions that I need to set? ... done this is setup the domain user account on the DC. ... permissions required on the local web server? ... this user must have some priviliges such as for schannel. ...
    (microsoft.public.inetserver.iis)