Re: Re: How to allow any domain user to logon to a XP Pro PC

From: Frank Clark (Frank_at_DontspamMeDesigns-by-design.Nospam.net)
Date: 10/02/04 

To: "Bruce Chambers" <bruce_a_chambers@h0tmail.com>
Date: Sat, 2 Oct 2004 10:03:16 -0600

Yes, AD (ACtive directory) is such a wonderful thing. If you have
Server or advanced server and you create a domain by using DC promo
you get that functionality and more. then you join the workstations
to the domain, this can easily be done when you are setup the system
or can be scripted. Then if you want to limit who can logon to a
particular system AD U&C >> User Properties >> Profile >> logon to
(goes with logon hours). teadious to do by hand but can be scripted
which makes it less tedious if you have more than a hand full of
computers.
Local accounts should be limited to only those that need to be there -
- ie best case scenario -- local administrator. If you have apps
that don't play well and need local access you may need local
accounts for that to for the domain accounts.

Frank Clark
10/1/2004 7:49:58 AM
Bruce Chambers <bruce_a_chambers@h0tmail.com> wrote in message
<u4WnK27pEHA.536@TK2MSFTNGP11.phx.gbl>

> jblaze wrote:
> > Hello.
> >
> > Can anyone tell me if and how it is possible to allow any Domain
> > User
> > (windows server 2003 std) the right to logon on to a Windows XP
Pro
> > Machine. This seems like it shouldn't be too hard but i can't
> > figure
> > it out.
> >
> > Right now, anytime I stage a new pc i have to go under Control
Panel
> > |
> > User Accounts | Add User | type in the user name and domain | and
> > define the users group membership as Administrators in order to
> > allow
> > them to logon.
> >
> > Realistically, it is not practical to perform these steps for
each
> > user that will using this PC.
> >
> > What i have tried.
> >
> > I have tried going under the PC's Group Policies and changing the
:
> > Local Computer Policy | Windows Settings | Security Settings |
Local
> > Policies | User Rights Assignment | Log On Locally and adding
the
> > 'domain users' group but it doesn't alow me to add or remove any
> > item
> > in this field.
> >
> > Also....
> >
> > I went under the doman security policies looking to change a
similar
> > setting but no luck there either.
> >
> > Thanks for your help.....
> >
> > ~JH
>
>
> Why not simply add the WinXP Pro computer to the domain? Then
any
> properly authenicated domain user will be able to log in without
you
> having to create local accounts for them. Ask you network or
domain
> administrator for assistance.
>
> --
>
> Bruce Chambers
>
> Help us help you:
> http://dts-l.org/goodpost.htm
> http://www.catb.org/~esr/faqs/smart-questions.html
>
> You can have peace. Or you can have freedom. Don't ever count on
> having
> both at once. - RAH

Relevant Pages

  • Re: New employee, same computer -- what to do?
    ... Doesn't that name become a local logon? ... The only local accounts you have to have are administrator and guest ... there's no real need to rename user accounts to ensure ... Let's see, I want to print to the $100 label printer, which *is* hung ...
    (microsoft.public.windows.server.active_directory)
  • Re: New employee, same computer -- what to do?
    ... The only local accounts you have to have are administrator and guest (the ... "Marketing department") permission to a resource, ... good domain logon password, but everyone has access to all the shared ... there's no real need to rename user accounts to ensure people ...
    (microsoft.public.windows.server.active_directory)
  • Re: Cant logon to local machine (this computer) as administrator
    ... Then I could get in to the local machine as administrator. ... I later cleaned up the mess by stipulating in each client. ... >> can not log into thier local accounts anymore. ...
    (microsoft.public.win2000.security)
  • Re: 2003 AD intergration with local Administrator Accounts on xp/win2k
    ... The restricted groups feature of Gp makes this easy to implement on a ... a workstation and a member server account are ... > My users are all engineers that have local accounts on their pc's ... > each local account has full Administrator access so they can do ...
    (microsoft.public.win2000.active_directory)
  • lsass.exe takes cpu times for a few minutes
    ... I posted this to security and administration group, but I had only one response so far. ... When I logon to my XP Pro box, the logon process runs very slowly. ... And when I logon to the box with other local accounts, ... I was advised to install and scan spyware, ...
    (microsoft.public.windowsxp.perform_maintain)