Re: User in two groups Admin and Power User

From: Doug Knox MS-MVP (dknox_at_mvps.org)
Date: 09/19/05


Date: Mon, 19 Sep 2005 16:01:34 -0400

Someone with more experience in domains and how the user accounts interact there would probably be able to give you more information.

-- 
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.
 
"BookerW" <BookerW@discussions.microsoft.com> wrote in message news:340E7549-2BE5-4F84-82C4-78145815139D@microsoft.com...
> Ok, seems kinda strange.  Seems to me, I have seen situations where a user 
> has been in both groups before (maybe in windows 2000) and the fact that 
> their account was in the administrators group seemed to override all otehr 
> groups.
> 
> And again, this was a case where the specifi user's account was in both the 
> administrators and the Power Users group, not the Administrator account 
> itself.   
> 
> I had another user logon who was a member of the domain admins group and by 
> default the administrator's group on the computer and he was able to 
> successfully load the software.
> 
> This is a new one to me, I assumed that as long as you were a part of the 
> administrator's group, it would trump your membership in other groups.
> 
> 
> 
> "Doug Knox MS-MVP" wrote:
> 
>> No, by default, Administrators are members of all groups, but this is transparent.  I would suspect that the fact that the Administrator was listed as a Power User, as well, caused any policies that prevented software installs to apply to the Administrator as well.  
>> 
>> -- 
>> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
>> Win 95/98/Me/XP Tweaks and Fixes
>> http://www.dougknox.com
>> --------------------------------
>> Per user Group Policy Restrictions for XP Home and XP Pro
>> http://www.dougknox.com/xp/utils/xp_securityconsole.htm
>> --------------------------------
>> Please reply only to the newsgroup so all may benefit.
>> Unsolicited e-mail is not answered.
>>  
>> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:ADEA51A7-2BED-46FD-A5BF-27A01843A560@microsoft.com...
>> > 
>> > If that is the case, what about the situation in which all authenticated 
>> > users are a part of the users group (i.e Administrators, etc).
>> > 
>> > Wouldn't that mean each administrator would be subjected to  the rules of 
>> > the users group, or is Administrator not a part of Authenticated users
>> > "Doug Knox MS-MVP" wrote:
>> > 
>> >> The lowest privilge is applied, to my knowledge.
>> >> 
>> >> -- 
>> >> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
>> >> Win 95/98/Me/XP Tweaks and Fixes
>> >> http://www.dougknox.com
>> >> --------------------------------
>> >> Per user Group Policy Restrictions for XP Home and XP Pro
>> >> http://www.dougknox.com/xp/utils/xp_securityconsole.htm
>> >> --------------------------------
>> >> Please reply only to the newsgroup so all may benefit.
>> >> Unsolicited e-mail is not answered.
>> >>  
>> >> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:2F4B98D2-4C4C-4BDD-AFB0-3618B5455096@microsoft.com...
>> >> > Does one group take precedence over the other.  I had a situation where the 
>> >> > user's accoutn was in both groups but when trying to install software, it 
>> >> > appeared as if he did not have enough privileges.  One of my technicians 
>> >> > signed in as administrator and was able to install the software without a 
>> >> > problem.   When he signed in as the user who was in both Power Users and 
>> >> > Admins, he said the install did not work. 
>> >> > 
>> >> > So the general question is how does Windows decide how to apply group 
>> >> > membership roles.
>> >>
>>