Power user group

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

By default, the Domain Admins group is auto added to the local Administrators
group of a Win machine (NT / 200x / XP) joined to a domain.

One way via your network login script:

net localgroup "power users" /add domain_name\domain_group

Alternatively, you can use "Restricted Group" in Group Policy to achieve the
same
goal. This also gives an added security benefit where the group membership is
constantly and automatically enforced.


"David Poultney" wrote:

> Hi All,
> I need to make members of a domain security group have power user rights on
> Windows XP Pro domain computers. The only way I can see to so this is to add
> the Domain group to the local power users group on every PC. As I have to do
> this on some 160 PC, anyone got any quicker solutions. The network is a
> Windows 2003 domain.
>
> Thanks All

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

David Poultney wrote:

> Hi All,
> I need to make members of a domain security group have power user rights on
> Windows XP Pro domain computers. The only way I can see to so this is to add
> the Domain group to the local power users group on every PC. As I have to do
> this on some 160 PC, anyone got any quicker solutions. The network is a
> Windows 2003 domain.
Hi

Two options for you:

A)
You could do it in a computer startup script (with a GPO) that runs
as part of the boot up process (before the user logs in). It runs
under the system context and has admin rights.


B)
Restricted Groups enforced with Group Policy is maybe an option:

http://groups.google.com/groups?selm=uM5aZa1YDHA.440%40...

and

How to Configure a Global Group to Be a Member of the Administrators Group on
all Workstations
http://support.microsoft.com/default.aspx?scid=kb;en-us;320065



--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.m...

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Thanks Torgeir & Desmond

I think the answer is in the article 'How to configure a global group to be
a member of the administrators group on all workstations. I will apply a new
GPO to the exsisting AD structure, modifying the instructions to allow the
global group member ship of the Power user local group.

All this would be needed if a software package I am upgrading installed with
elevated rights.

Many Thanks

David



"Torgeir Bakken (MVP)" wrote:

> David Poultney wrote:
>
> > Hi All,
> > I need to make members of a domain security group have power user rights on
> > Windows XP Pro domain computers. The only way I can see to so this is to add
> > the Domain group to the local power users group on every PC. As I have to do
> > this on some 160 PC, anyone got any quicker solutions. The network is a
> > Windows 2003 domain.
> Hi
>
> Two options for you:
>
> A)
> You could do it in a computer startup script (with a GPO) that runs
> as part of the boot up process (before the user logs in). It runs
> under the system context and has admin rights.
>
>
> B)
> Restricted Groups enforced with Group Policy is maybe an option:
>
> http://groups.google.com/groups?selm=uM5aZa1YDHA.440%40...
>
> and
>
> How to Configure a Global Group to Be a Member of the Administrators Group on
> all Workstations
> http://support.microsoft.com/default.aspx?scid=kb;en-us;320065
>
>
>
> --
> torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scriptcenter/default.m...
>

Create a new group (i.e. XP Power Users) and add the 150 users to this group.

Right click on the OU containing the computers. Select the Group Policy tab. Select Open.

(Note- If you do not have Group Policy Management Console installed you can select the GPO from the list in that tab and select edit)

If you're using GP Mgmt Console a new window will pop up, locate your GPO, right click edit.
Go to Computer Configuration\Windows Settings\Security Settings\Restricted Groups\

Right click restricted Groups and select ADD GROUP. Type in the newly created group (i.e XP Power Users)
On the next window go to the THIS GROUP IS A MEMBER OF field and click add, type Power Users and click OK. (do not browse