Re: Simple way to how domain users log on as restricted users?

From: Roger Abell [MVP] (mvpNOSPAM@asu.edu)
Date: 01/29/03 

From: "Roger Abell [MVP]" <mvpNOSPAM@asu.edu>
Date: Wed, 29 Jan 2003 05:55:06 -0700

When you join a machine to a domain a few things happen,
including adding domain\Domain Admins to machine\Administrators
and domain\Domain Users to machine\Users
This makes all members of Domain Users local restricted users.
If you are seeing something else, then check the membership of
the machine local groups. You said all Domain Users are not
restricted users. You did not say why you believe that to be so.
A restricted user is just an account that is a member of the local
Users account and not of Power Users or Administrators. This
is what you should have gotten as soon as the machines joined
the domain. 

--
Roger Abell
MS MVP (Security, Windows), MCDBA,  MCSE both
Associate Expert - Windows XP ExpertZone
http://www.microsoft.com/windowsxp/expertzone
"Phil" <worleyp@valley.k12.co.us> wrote in message
news:00ed01c2c75b$b7195fc0$cef82ecf@TK2MSFTNGXA08...
> Roger,
>
> Please give a little more detail.
>
> So, we should add student\users to the local users group
> on each local computer?  And make sure we do not have any
> other student\(group)?
>
> Thanks, Roger, for any additional detail!
>
> Phil  :)
> >-----Original Message-----
> >Make certain that the Domain Users group is a member
> >only in the local Users group and none other.
> >
> >--
> >Roger
> >
> >"Phil" <worleyp@valley.k12.co.us> wrote in message
> >news:ea9e01c2c756$8e2cf0e0$8bf82ecf@TK2MSFTNGXA05...
> >> Just installed XP Pro machines in one of our labs.
> Just
> >> noticed that when domain users log on, they are not
> >> restricted users!  On our 2000 Pro machines, domain
> users
> >> came in as restricted users!  What is the simplest way
> to
> >> make sure domain users logging on come in as restricted
> >> users?  Thank you so much for any quick help with this!
> >> Phil
> >
> >
> >.
> >

Relevant Pages

  • Re: Too many groups problem
    ... Thanks for that response Mike, not quite what I wanted to hear, but at least ... project work, so if you happen to be senior manager, it is feasible that you ... end up being a member of a huge amount of groups, ... >> This only happens to those accounts, so i have ruled out the machines ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Local Admins
    ... > Is there an easy way to scan 2K/XP machines to determine who is a member of ... > the administrator groups? ... > have over 1000 machines in our domain and I really don't want to try and run ... firewall security suite that prevent Web applications attacks, ...
    (Focus-Microsoft)
  • Re: Simple way to how domain users log on as restricted users?
    ... restricted users, or is there more than this software install ... Some software will install as users for use by the ... machines using NTFS? ... >>This makes all members of Domain Users local restricted ...
    (microsoft.public.windowsxp.security_admin)
  • Re: char data[0]
    ... types have the alignment of their most restrictive member. ... compilers on most 32-bit machines today set up ... to be independant of struct alignment, ...
    (comp.lang.c)
  • Re: Add additional domain group to local admins groups?
    ... but not be domain admins. ... If it's only about granting the rights for adding machines and accounts to ... simply have to select the group and add them under "This group is a member ...
    (microsoft.public.windows.group_policy)