Re: Simple way to how domain users log on as restricted users?

From: Roger Abell [MVP] (mvpNOSPAM@asu.edu)
Date: 01/30/03 

From: "Roger Abell [MVP]" <mvpNOSPAM@asu.edu>
Date: Wed, 29 Jan 2003 23:52:27 -0700

So you have now said why by believed they were not
restricted users, or is there more than this software install
thing ? Some software will install as users for use by the
installing user. Have you ruled this out ? Are your XP
machines using NTFS ? 

--
Roger
"Phil" <worleyp@valley.k12.co.us> wrote in message
news:03fa01c2c7ac$1dcc5d30$8ef82ecf@TK2MSFTNGXA04...
> Thanks for the follow-up, Roger!
>
> I checked each of the computers this morning, and it's as
> you suggested:  domain\users are only under the group
> Users - no where else.
>
> Domain users are able to install programs and do other
> restricted activity - this does not happen with our 2000
> Pro machines.
>
> Any other ideas?
>
> Thanks!
>
> Phil
> >-----Original Message-----
> >When you join a machine to a domain a few things happen,
> >including adding domain\Domain Admins to
> machine\Administrators
> >and domain\Domain Users to machine\Users
> >This makes all members of Domain Users local restricted
> users.
> >If you are seeing something else, then check the
> membership of
> >the machine local groups.  You said all Domain Users are
> not
> >restricted users.  You did not say why you believe that
> to be so.
> >A restricted user is just an account that is a member of
> the local
> >Users account and not of Power Users or Administrators.
> This
> >is what you should have gotten as soon as the machines
> joined
> >the domain.
> >
> >--
> >Roger Abell
> >MS MVP (Security, Windows), MCDBA,  MCSE both
> >Associate Expert - Windows XP ExpertZone
> >http://www.microsoft.com/windowsxp/expertzone
> >
> >"Phil" <worleyp@valley.k12.co.us> wrote in message
> >news:00ed01c2c75b$b7195fc0$cef82ecf@TK2MSFTNGXA08...
> >> Roger,
> >>
> >> Please give a little more detail.
> >>
> >> So, we should add student\users to the local users
> group
> >> on each local computer?  And make sure we do not have
> any
> >> other student\(group)?
> >>
> >> Thanks, Roger, for any additional detail!
> >>
> >> Phil  :)
> >> >-----Original Message-----
> >> >Make certain that the Domain Users group is a member
> >> >only in the local Users group and none other.
> >> >
> >> >--
> >> >Roger
> >> >
> >> >"Phil" <worleyp@valley.k12.co.us> wrote in message
> >> >news:ea9e01c2c756$8e2cf0e0$8bf82ecf@TK2MSFTNGXA05...
> >> >> Just installed XP Pro machines in one of our labs.
> >> Just
> >> >> noticed that when domain users log on, they are not
> >> >> restricted users!  On our 2000 Pro machines, domain
> >> users
> >> >> came in as restricted users!  What is the simplest
> way
> >> to
> >> >> make sure domain users logging on come in as
> restricted
> >> >> users?  Thank you so much for any quick help with
> this!
> >> >> Phil
> >> >
> >> >
> >> >.
> >> >
> >
> >
> >.
> >

Relevant Pages

  • Re: restricting software installation
    ... How would I go about setting up an OU and will that new OU disrupt my SBS ... > native state as per initial install, then just making the domain users ... > their install capabilities. ... > the OU that holds the real client machines. ...
    (microsoft.public.windows.server.security)
  • Re: restricting software installation
    ... that if you client machines are XP at a relatively ... native state as per initial install, then just making the domain users ... their install capabilities. ...
    (microsoft.public.windows.server.security)
  • Re: Stop Installiing Everything
    ... you need to remove all domain users ... All machines must moved to the machine's OU ... you can disable their access..MSI install or any legacy applications... ... > Start by removing them from the local admin group and only adding only ...
    (microsoft.public.win2000.group_policy)
  • Re: Simple way to how domain users log on as restricted users?
    ... This makes all members of Domain Users local restricted users. ... A restricted user is just an account that is a member of the local ... >>Make certain that the Domain Users group is a member ... >>> Just installed XP Pro machines in one of our labs. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Setup question
    ... You can temporarily promote your restricted users to Admins to install ... don't want this user to be able to change any functions on their profile. ...
    (microsoft.public.windowsxp.general)