Re: Windows XP Security and NT Domain

From: Doug Leisher (dleisher@sfsd.k12.pa.us)
Date: 01/15/03 

From: "Doug Leisher" <dleisher@sfsd.k12.pa.us>
Date: Wed, 15 Jan 2003 06:13:40 -0800

Sorry I wasn't more specific. The user can change system
settings when logged onto the domain but cannot change
these when logged onto the computer locally. For example,
if logged onto the domain, they can go into User Accounts
and make changes but if they logon to the computer itself,
they cannot even get into User Accounts.

I check on your suggestion about the "Domain Users".

Thanks!
  Doug

>-----Original Message-----
>What do you mean by able to do anything ?
>You say system settings, but did not give any examples
>of system settings so we are not sure whether this is or
>is not normal behavior. All Users does allow for Power
>Users to make changes to it.
>
>Just to be sure, check that Domain Users is not a member
of
>the local Administrators or more likely Power Users group.
>
>--
>Roger
>
>"Doug Leisher" <dleisher@sfsd.k12.pa.us> wrote in message
>news:457b01c2bbf4$a6eab850$d6f82ecf@TK2MSFTNGXA13...
>> I have Windows XP Professional (SP1) and NTFS file
>> system. If a user logs onto the computer then
everything
>> as far as security on the computer is fine. However,
when
>> they log onto the Windows NT domain using the XP
computer,
>> they are able to do anything (e.g., change system
>> settings, change "All User" settings, etc.) It appears
>> that logging onto the domain bypasses all the local
>> security.
>>
>> I created a generic user account and set it up with User
>> authority and made this the default profile so that all
>> new users would use the profile but this didn't help.
>>
>> Any suggestions?
>> Thanks!
>
>
>.
>

Relevant Pages

  • Re: Cannot logon to "(local machine)"
    ... Guide to User Data and User Settings ... Each PC can operate without the network. ... > My Documents folder within the user's profile. ... > specified for individual user accounts, via Group Policy or a logon script. ...
    (microsoft.public.win2000.group_policy)
  • Re: User Login
    ... The setting I'm referring to in item #1 is a Computer Configuration setting, so applying a GPO with this setting to an OU that only has User Accounts in it will have no affect whatsoever. ... The GPO must be applied to an OU that has Computer Accounts in it to be any use. ... If you want to, you can specify the user accounts in the GPO setting (Computer Configuration, Windows Settings, Security Settings, Local Policies, User Rights Assignment Deny log on locally), but I suspect it will be easier in the long run to specify a group name here and put the e-mail only user accounts into that group. ... the domain group called Domain Users is a member of the local Users group on all computers; this is usually why any domain user can logon at any domin member computer. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Search Links in IE6 dont work after uninstall of IE7 Beta 2
    ... On changing security settings at the behest of IE7: ... On the first profile, I changed the levels for each zone in Internet ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: restrict access to AD:USER properties for a particular set of
    ... The settings that you define at the OU permission level ... to advanced security settings, selct add, select Jane Doe and then ther ... You can choose user accounts, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Startup user selection vs small-fill-in-the-blank
    ... back to the XP default showing the users (with a silly icon). ... I was messing with settings to get sharing working within my subnet and inadvertantly got the settings stuck with the rectangle wherein I must fill in my user name. ... To specify that users log on to the computer using the Welcome screen, select the Use the Welcome screen check box. ... To open User Accounts, click Start, click Control Panel, and then click User Accounts. ...
    (microsoft.public.windowsxp.general)