Re: debugger user autochange

One possibility could be that Group Policy Restricted Groups are being
applied to the computers in question. I believe if you run rsop.msc on one
of the computers it should show if Restricted Groups are being applied to it
and by what Group Policy. RG can enforce group membership on domain
computers as in it can make sure that the users are members of certain
groups and not members of certain groups. It will not stop you from
configuring groups on the local computer but at the next GP refresh it will
change them back to the RG settings. The link below explains RG more and how
they are configured.

Steve

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

"dego" <dego@xxxxxxxxxxxxxx> wrote in message
news:3AC39380-FAAF-4469-8A1C-670C1E7B143F@xxxxxxxxxxxxxxxx
Thanks for the response Steve!
I think I failed to convey the problem clearly - the user accounts
themselves are not being changed, only the rights - and then only for the
domain accounts - seemingly at random. We have gone into the local
machines
and enabled the domain user - by name - to be a local administrator - the
user panel shows
domain/userxyz assigned to the administrator group. Then at some point
in time - the user account is being removed from the administrator group
and
reassigned to the Debugger User group. Local accounts are not affected -
only the domain accounts. But it is not consistent...
Any other ideas?

thanks,
Don

"Steven L Umbach" wrote:

One possibility is that Local Security Policy or the policy that enforces
the setting, is renaming the administrator acount. You can see that
security
option in Local Security Policy/local policies/security options -
accounts:
rename administrator account.

Steve


"dego" <dego@xxxxxxxxxxxxxx> wrote in message
news:AAC45234-E6AE-4CD3-A537-FD9DC001FCC1@xxxxxxxxxxxxxxxx
We have several systems that keep changing our users from Administrator
to Debugger User on the local policy. We change the account back to
Administrator
but something (windows updates?) changes the account back to Debugger
User.
I cannot find anything obvious in the group policy (2003std) to affect
this.
Any ideas or help would be welcome.

Don Degner





.

Relevant Pages

  • Re: Administrator restricted - Control Panel Missing
    ... If you did not specifically set up Group Policy to restrict access to ... The command net users will display user accounts and net user username will ... type of administrator. ... the control panel was missing. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: This operation has been canceled due to restrictions in effect on this computer. When Logging i
    ... Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub: ... >have administrator privileges. ... >> happening on a few computers, other computers get no error messages ... >> fine but I can't figure out why it is trying to startup. ...
    (microsoft.public.windows.group_policy)
  • Re: access denied error when opening gpedit.msc
    ... If you configured Group Policy to prevent users from accessing MMC, ... possible that you did not filter the administrators group assuming you are talking ... If these computers are in an OU other than the domain ... I am logged on with an Administrator account. ...
    (microsoft.public.win2000.security)
  • Re: Domain Users to have Local Admin rights
    ... We have various admin accounts other then administrator ... administrator accounts to logon to user computers. ... Now add this group to Local Administrator group by using ...
    (microsoft.public.windows.server.security)
  • Re: Domain Users to have Local Admin rights
    ... But then we are startup scripts? ... Administrator group on all the computers. ... We have various admin accounts other then administrator ...
    (microsoft.public.windows.server.security)