Re: Default Domain Users group

You could remove Domain Users from local Users, but that would presume that
you were trying to allow local accounts but prevent domain accounts, and it
does not sound as though that is what you had in mind.
If you want to control who can log on locally, the place to do it is in the
User Rights Assignment policy: either the local security policy or an
applied Group Policy. If you want to prevent people apart from
administrators from logging on locally, in User Rights Assignment just
remove the Users group from the right to Log on Locally.
Hope that helps,
Anthony,
http://www.airdesk.co.uk




"Pete" <Pete@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:7B65A2F5-31C0-40CF-9015-8D2DD48F4C07@xxxxxxxxxxxxxxxx
Hello,
Would it be safe for me to remove Domain users group from servers local
users group? I understand the purporse of this group on the workstations
side
but not sure why it would be in the server that has joined Domain.

If no local security restrictions are in place then any domain users will
be
able to log into the server via console.


Thank you in advance for your suggestions and reading this post!!


.

Relevant Pages

  • Re: restricted groups
    ... on the focus of the school and the instructors of said school). ... Microsoft Active Directory MVP ... It requires them to be a member of the power users group. ... >>> restricted group setting to make the domain users group a member of the ...
    (microsoft.public.windows.server.active_directory)
  • Re: Least amount of privileges
    ... It depends on what the domain users group has for permissions. ... Does this third party program have a service account that runs the app for ... moving this app off of your sql server and put it on a seperate server. ...
    (microsoft.public.windows.server.active_directory)
  • Re: restricted groups
    ... Both Herb and Gary mention the need of this Adminpak ... and working from a workstation to get this to work. ... >>I have an application that all domain users must be able to run on a local ... It requires them to be a member of the power users group. ...
    (microsoft.public.windows.server.active_directory)
  • Re: restricted groups
    ... >I have an application that all domain users must be able to run on a local ... It requires them to be a member of the power users group. ... > Why is the restricted group policy not working for me. ...
    (microsoft.public.windows.server.active_directory)
  • Re: allowing all domain user to be a powerusers on window XP
    ... You can add the domain users group to the power users group on any XP ... > personal client but is there a way to do it so that they are automatically ...
    (microsoft.public.windows.server.general)