Re: Group permissions

"NINA" <NINA@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A14504FE-C226-4AB2-AD75-164FCAC5B2CC@xxxxxxxxxxxxxxxx
It is a local group, but for some reason group privileges do not work.

Can we please verify what AD based GPOs are applied to the
test system, and what settings they carry for these user rights, if
they carry any. Usually, if one can set these in Local Security
Policy admin tool, then they are not under control by AD GPO.

Is it possible that in your tests you were seeing results had variance
due to whether the changed local policy had or had not yet been
applied? Did you use gpupdate (or secedit if W2k) to force the
changed local policy to be applied after you added the group?

As Joe stated, I will echo - this does work, I use it all the time.

Roger

"Joe Richards [MVP]" wrote:

Is the group a local group or a domain local group?

When you look at the security token do you see the group listed in the
token when you log into the machine?

This should work fine, I have done this thousands of times through the
years.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


NINA wrote:
I have created a local admin group(testgroup) and assigned a particular
user
(testuser)to that group and then assigned that group(testgroup) to the
following local policies:

act as part of the operating system
log on as a service
log on locally

I am not able to perform a particular function. If I assign the
testuser
explicitly to those same local policies I can. The customer has a GPO
that
does not allow individual users the ability to be assigned local
policies.
Is there anyway around this?



.

Relevant Pages

  • Re: Login Script
    ... file is stored in the folder ... You are working with local policies, so all things you manipulate are ... remove auth.Users from the GPO and add: ... by Security Group, or use ifmember.exe inside your batch. ...
    (microsoft.public.windows.group_policy)
  • Re: Group permissions
    ... act as part of the operating system ... explicitly to those same local policies I can. ... The customer has a GPO ... user accounts. ...
    (microsoft.public.win2000.security)
  • Re: Windows 2003 Server IP address
    ... the server is not in a domain.. ... > any local policies in effect? ... This sounds like a GPO going into effect. ... Prev by Date: ...
    (microsoft.public.windows.server.general)