User in two groups Admin and Power User

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Does one group take precedence over the other. I had a situation where the
user's accoutn was in both groups but when trying to install software, it
appeared as if he did not have enough privileges. One of my technicians
signed in as administrator and was able to install the software without a
problem. When he signed in as the user who was in both Power Users and
Admins, he said the install did not work.

So the general question is how does Windows decide how to apply group
membership roles.

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

If that is the case, what about the situation in which all authenticated
users are a part of the users group (i.e Administrators, etc).

Wouldn't that mean each administrator would be subjected to the rules of
the users group, or is Administrator not a part of Authenticated users
"Doug Knox MS-MVP" wrote:

> The lowest privilge is applied, to my knowledge.
>
> --
> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
> Win 95/98/Me/XP Tweaks and Fixes
> http://www.dougknox.com
> --------------------------------
> Per user Group Policy Restrictions for XP Home and XP Pro
> http://www.dougknox.com/xp/utils/x [...] onsole.htm
> --------------------------------
> Please reply only to the newsgroup so all may benefit.
> Unsolicited e-mail is not answered.
>
> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:2F4B98D2-4C4C-4BDD-AFB0-3618B5455096@microsoft.com...
> > Does one group take precedence over the other. I had a situation where the
> > user's accoutn was in both groups but when trying to install software, it
> > appeared as if he did not have enough privileges. One of my technicians
> > signed in as administrator and was able to install the software without a
> > problem. When he signed in as the user who was in both Power Users and
> > Admins, he said the install did not work.
> >
> > So the general question is how does Windows decide how to apply group
> > membership roles.
>

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Ok, seems kinda strange. Seems to me, I have seen situations where a user
has been in both groups before (maybe in windows 2000) and the fact that
their account was in the administrators group seemed to override all otehr
groups.

And again, this was a case where the specifi user's account was in both the
administrators and the Power Users group, not the Administrator account
itself.

I had another user logon who was a member of the domain admins group and by
default the administrator's group on the computer and he was able to
successfully load the software.

This is a new one to me, I assumed that as long as you were a part of the
administrator's group, it would trump your membership in other groups.



"Doug Knox MS-MVP" wrote:

> No, by default, Administrators are members of all groups, but this is transparent. I would suspect that the fact that the Administrator was listed as a Power User, as well, caused any policies that prevented software installs to apply to the Administrator as well.
>
> --
> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
> Win 95/98/Me/XP Tweaks and Fixes
> http://www.dougknox.com
> --------------------------------
> Per user Group Policy Restrictions for XP Home and XP Pro
> http://www.dougknox.com/xp/utils/x [...] onsole.htm
> --------------------------------
> Please reply only to the newsgroup so all may benefit.
> Unsolicited e-mail is not answered.
>
> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:ADEA51A7-2BED-46FD-A5BF-27A01843A560@microsoft.com...
> >
> > If that is the case, what about the situation in which all authenticated
> > users are a part of the users group (i.e Administrators, etc).
> >
> > Wouldn't that mean each administrator would be subjected to the rules of
> > the users group, or is Administrator not a part of Authenticated users
> > "Doug Knox MS-MVP" wrote:
> >
> >> The lowest privilge is applied, to my knowledge.
> >>
> >> --
> >> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
> >> Win 95/98/Me/XP Tweaks and Fixes
> >> http://www.dougknox.com
> >> --------------------------------
> >> Per user Group Policy Restrictions for XP Home and XP Pro
> >> http://www.dougknox.com/xp/utils/x [...] onsole.htm
> >> --------------------------------
> >> Please reply only to the newsgroup so all may benefit.
> >> Unsolicited e-mail is not answered.
> >>
> >> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:2F4B98D2-4C4C-4BDD-AFB0-3618B5455096@microsoft.com...
> >> > Does one group take precedence over the other. I had a situation where the
> >> > user's accoutn was in both groups but when trying to install software, it
> >> > appeared as if he did not have enough privileges. One of my technicians
> >> > signed in as administrator and was able to install the software without a
> >> > problem. When he signed in as the user who was in both Power Users and
> >> > Admins, he said the install did not work.
> >> >
> >> > So the general question is how does Windows decide how to apply group
> >> > membership roles.
> >>
>

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Is this the right forum for this question?



"Doug Knox MS-MVP" wrote:

> Someone with more experience in domains and how the user accounts interact there would probably be able to give you more information.
>
> --
> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
> Win 95/98/Me/XP Tweaks and Fixes
> http://www.dougknox.com
> --------------------------------
> Per user Group Policy Restrictions for XP Home and XP Pro
> http://www.dougknox.com/xp/utils/x [...] onsole.htm
> --------------------------------
> Please reply only to the newsgroup so all may benefit.
> Unsolicited e-mail is not answered.
>
> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:340E7549-2BE5-4F84-82C4-78145815139D@microsoft.com...
> > Ok, seems kinda strange. Seems to me, I have seen situations where a user
> > has been in both groups before (maybe in windows 2000) and the fact that
> > their account was in the administrators group seemed to override all otehr
> > groups.
> >
> > And again, this was a case where the specifi user's account was in both the
> > administrators and the Power Users group, not the Administrator account
> > itself.
> >
> > I had another user logon who was a member of the domain admins group and by
> > default the administrator's group on the computer and he was able to
> > successfully load the software.
> >
> > This is a new one to me, I assumed that as long as you were a part of the
> > administrator's group, it would trump your membership in other groups.
> >
> >
> >
> > "Doug Knox MS-MVP" wrote:
> >
> >> No, by default, Administrators are members of all groups, but this is transparent. I would suspect that the fact that the Administrator was listed as a Power User, as well, caused any policies that prevented software installs to apply to the Administrator as well.
> >>
> >> --
> >> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
> >> Win 95/98/Me/XP Tweaks and Fixes
> >> http://www.dougknox.com
> >> --------------------------------
> >> Per user Group Policy Restrictions for XP Home and XP Pro
> >> http://www.dougknox.com/xp/utils/x [...] onsole.htm
> >> --------------------------------
> >> Please reply only to the newsgroup so all may benefit.
> >> Unsolicited e-mail is not answered.
> >>
> >> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:ADEA51A7-2BED-46FD-A5BF-27A01843A560@microsoft.com...
> >> >
> >> > If that is the case, what about the situation in which all authenticated
> >> > users are a part of the users group (i.e Administrators, etc).
> >> >
> >> > Wouldn't that mean each administrator would be subjected to the rules of
> >> > the users group, or is Administrator not a part of Authenticated users
> >> > "Doug Knox MS-MVP" wrote:
> >> >
> >> >> The lowest privilge is applied, to my knowledge.
> >> >>
> >> >> --
> >> >> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
> >> >> Win 95/98/Me/XP Tweaks and Fixes
> >> >> http://www.dougknox.com
> >> >> --------------------------------
> >> >> Per user Group Policy Restrictions for XP Home and XP Pro
> >> >> http://www.dougknox.com/xp/utils/x [...] onsole.htm
> >> >> --------------------------------
> >> >> Please reply only to the newsgroup so all may benefit.
> >> >> Unsolicited e-mail is not answered.
> >> >>
> >> >> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:2F4B98D2-4C4C-4BDD-AFB0-3618B5455096@microsoft.com...
> >> >> > Does one group take precedence over the other. I had a situation where the
> >> >> > user's accoutn was in both groups but when trying to install software, it
> >> >> > appeared as if he did not have enough privileges. One of my technicians
> >> >> > signed in as administrator and was able to install the software without a
> >> >> > problem. When he signed in as the user who was in both Power Users and
> >> >> > Admins, he said the install did not work.
> >> >> >
> >> >> > So the general question is how does Windows decide how to apply group
> >> >> > membership roles.
> >> >>
> >>
>

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

This appears to be a mix-up between Local User accounts
and Active Directory Accounts. An account that can log
on to the local machine, as a local administrator can install
anything that it has access to.

If the Network resource is open to "everybody", then the
Local Administrator of a computer can access that network
share (for example) and install the software on the PC.

If both the Domain Account and the Local Account have the
same name, then the difference is determined during the login;
i.e.: Whether you logon to (This Computer) or the Domain.

--
Cheers, Windows XP MVP Shell / User
Jimmy S. http://mvp.support.microsoft.com

Visit my MSN Zone.com and Gaming Help Site: http://mvps.org/nibblesnbits
MS Games Help and Support Center: http://support.microsoft.com/?pr=gms
My advice is donated "AS IS" without warranty; nor do I confer any rights.
_________________________________________________________

"Doug Knox MS-MVP" <dknox@mvps.org> wrote in message news:etKTaRXvFHA.2132@TK2MSFTNGP15.phx.gbl...
You might try microsoft.public.windows.server.active_directory if no else can give you a definitive answer here.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/x [...] onsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"BookerW" <BookerW@discussions.microsoft.com> wrote in message news:9BD98AD2-D211-4B11-B48E-9F39A1B213E3@microsoft.com...
> Is this the right forum for this question?
>
>
>
> "Doug Knox MS-MVP" wrote:
>
>> Someone with more experience in domains and how the user accounts interact there would probably be able to give you more
>> information.
>>
>> --
>> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
>> Win 95/98/Me/XP Tweaks and Fixes
>> http://www.dougknox.com
>> --------------------------------
>> Per user Group Policy Restrictions for XP Home and XP Pro
>> http://www.dougknox.com/xp/utils/x [...] onsole.htm
>> --------------------------------
>> Please reply only to the newsgroup so all may benefit.
>> Unsolicited e-mail is not answered.
>>
>> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:340E7549-2BE5-4F84-82C4-78145815139D@microsoft.com...
>> > Ok, seems kinda strange. Seems to me, I have seen situations where a user
>> > has been in both groups before (maybe in windows 2000) and the fact that
>> > their account was in the administrators group seemed to override all otehr
>> > groups.
>> >
>> > And again, this was a case where the specifi user's account was in both the
>> > administrators and the Power Users group, not the Administrator account
>> > itself.
>> >
>> > I had another user logon who was a member of the domain admins group and by
>> > default the administrator's group on the computer and he was able to
>> > successfully load the software.
>> >
>> > This is a new one to me, I assumed that as long as you were a part of the
>> > administrator's group, it would trump your membership in other groups.
>> >
>> >
>> >
>> > "Doug Knox MS-MVP" wrote:
>> >
>> >> No, by default, Administrators are members of all groups, but this is transparent. I would suspect that the fact that the
>> >> Administrator was listed as a Power User, as well, caused any policies that prevented software installs to apply to the
>> >> Administrator as well.
>> >>
>> >> --
>> >> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
>> >> Win 95/98/Me/XP Tweaks and Fixes
>> >> http://www.dougknox.com
>> >> --------------------------------
>> >> Per user Group Policy Restrictions for XP Home and XP Pro
>> >> http://www.dougknox.com/xp/utils/x [...] onsole.htm
>> >> --------------------------------
>> >> Please reply only to the newsgroup so all may benefit.
>> >> Unsolicited e-mail is not answered.
>> >>
>> >> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:ADEA51A7-2BED-46FD-A5BF-27A01843A560@microsoft.com...
>> >> >
>> >> > If that is the case, what about the situation in which all authenticated
>> >> > users are a part of the users group (i.e Administrators, etc).
>> >> >
>> >> > Wouldn't that mean each administrator would be subjected to the rules of
>> >> > the users group, or is Administrator not a part of Authenticated users
>> >> > "Doug Knox MS-MVP" wrote:
>> >> >
>> >> >> The lowest privilge is applied, to my knowledge.
>> >> >>
>> >> >> --
>> >> >> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
>> >> >> Win 95/98/Me/XP Tweaks and Fixes
>> >> >> http://www.dougknox.com
>> >> >> --------------------------------
>> >> >> Per user Group Policy Restrictions for XP Home and XP Pro
>> >> >> http://www.dougknox.com/xp/utils/x [...] onsole.htm
>> >> >> --------------------------------
>> >> >> Please reply only to the newsgroup so all may benefit.
>> >> >> Unsolicited e-mail is not answered.
>> >> >>
>> >> >> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:2F4B98D2-4C4C-4BDD-AFB0-3618B5455096@microsoft.com...
>> >> >> > Does one group take precedence over the other. I had a situation where the
>> >> >> > user's accoutn was in both groups but when trying to install software, it
>> >> >> > appeared as if he did not have enough privileges. One of my technicians
>> >> >> > signed in as administrator and was able to install the software without a
>> >> >> > problem. When he signed in as the user who was in both Power Users and
>> >> >> > Admins, he said the install did not work.
>> >> >> >
>> >> >> > So the general question is how does Windows decide how to apply group
>> >> >> > membership roles.
>> >> >>
>> >>
>>

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Hi Booker,

In that case, it looks like the Group Policy doesn't allow the local
Power Users / Administrators to install that particular software.

GPO's (Group Policy Objects) can be linked to specific containers
such as Computer Groups. Have your technician verify that using
the Group Policy Management MMC Snap-in to be certain. :-)

--
Cheers, Windows XP MVP Shell / User
Jimmy S. http://mvp.support.microsoft.com

Visit my MSN Zone.com and Gaming Help Site: http://mvps.org/nibblesnbits
MS Games Help and Support Center: http://support.microsoft.com/?pr=gms
My advice is donated "AS IS" without warranty; nor do I confer any rights.
_________________________________________________________

"BookerW" <BookerW@discussions.microsoft.com> wrote in message news:9A21EDB5-A852-429D-93BC-4E29190DD9A5@microsoft.com...
|
| In this case, the user account was a domain account, and I believe my
| technician logged on as a domain admin. Again, in this case, the technician
| logged in as a domain admin and the software installed correctly.
|
|
| "Jimmy S." wrote:
|
| > This appears to be a mix-up between Local User accounts
| > and Active Directory Accounts. An account that can log
| > on to the local machine, as a local administrator can install
| > anything that it has access to.
| >
| > If the Network resource is open to "everybody", then the
| > Local Administrator of a computer can access that network
| > share (for example) and install the software on the PC.
| >
| > If both the Domain Account and the Local Account have the
| > same name, then the difference is determined during the login;
| > i.e.: Whether you logon to (This Computer) or the Domain.
| >
| > --
| > Cheers, Windows XP MVP Shell / User
| > Jimmy S. http://mvp.support.microsoft.com
| >
| > Visit my MSN Zone.com and Gaming Help Site: http://mvps.org/nibblesnbits
| > MS Games Help and Support Center: http://support.microsoft.com/?pr=gms
| > My advice is donated "AS IS" without warranty; nor do I confer any rights.
| > _________________________________________________________
| >
| > "Doug Knox MS-MVP" <dknox@mvps.org> wrote in message news:etKTaRXvFHA.2132@TK2MSFTNGP15.phx.gbl...
| > You might try microsoft.public.windows.server.active_directory if no else can give you a definitive answer here.
| >
| > --
| > Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
| > Win 95/98/Me/XP Tweaks and Fixes
| > http://www.dougknox.com
| > --------------------------------
| > Per user Group Policy Restrictions for XP Home and XP Pro
| > http://www.dougknox.com/xp/utils/x [...] onsole.htm
| > --------------------------------
| > Please reply only to the newsgroup so all may benefit.
| > Unsolicited e-mail is not answered.
| >
| > "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:9BD98AD2-D211-4B11-B48E-9F39A1B213E3@microsoft.com...
| > > Is this the right forum for this question?
| > >
| > >
| > >
| > > "Doug Knox MS-MVP" wrote:
| > >
| > >> Someone with more experience in domains and how the user accounts interact there would probably be able to give you more
| > >> information.
| > >>
| > >> --
| > >> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
| > >> Win 95/98/Me/XP Tweaks and Fixes
| > >> http://www.dougknox.com
| > >> --------------------------------
| > >> Per user Group Policy Restrictions for XP Home and XP Pro
| > >> http://www.dougknox.com/xp/utils/x [...] onsole.htm
| > >> --------------------------------
| > >> Please reply only to the newsgroup so all may benefit.
| > >> Unsolicited e-mail is not answered.
| > >>
| > >> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:340E7549-2BE5-4F84-82C4-78145815139D@microsoft.com...
| > >> > Ok, seems kinda strange. Seems to me, I have seen situations where a user
| > >> > has been in both groups before (maybe in windows 2000) and the fact that
| > >> > their account was in the administrators group seemed to override all otehr
| > >> > groups.
| > >> >
| > >> > And again, this was a case where the specifi user's account was in both the
| > >> > administrators and the Power Users group, not the Administrator account
| > >> > itself.
| > >> >
| > >> > I had another user logon who was a member of the domain admins group and by
| > >> > default the administrator's group on the computer and he was able to
| > >> > successfully load the software.
| > >> >
| > >> > This is a new one to me, I assumed that as long as you were a part of the
| > >> > administrator's group, it would trump your membership in other groups.
| > >> >
| > >> >
| > >> >
| > >> > "Doug Knox MS-MVP" wrote:
| > >> >
| > >> >> No, by default, Administrators are members of all groups, but this is transparent. I would suspect that the fact that the
| > >> >> Administrator was listed as a Power User, as well, caused any policies that prevented software installs to apply to the
| > >> >> Administrator as well.
| > >> >>
| > >> >> --
| > >> >> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
| > >> >> Win 95/98/Me/XP Tweaks and Fixes
| > >> >> http://www.dougknox.com
| > >> >> --------------------------------
| > >> >> Per user Group Policy Restrictions for XP Home and XP Pro
| > >> >> http://www.dougknox.com/xp/utils/x [...] onsole.htm
| > >> >> --------------------------------
| > >> >> Please reply only to the newsgroup so all may benefit.
| > >> >> Unsolicited e-mail is not answered.
| > >> >>
| > >> >> "BookerW" <BookerW@discussions.microsoft.com> wrote in message news:ADEA51A7-2BED-46FD-A5BF-27A01843A560@microsoft.com...
| > >> >> >
| > >> >> > If that is the case, what about the situation in which all authenticated
| > >> >> > users are a part of the users group (i.e Administrators, etc).
| > >> >> >
| > >> >> > Wouldn't that mean each administrator would be subjected to the rules of
| > >> >> > the users group, or is Administrator not a part of Authenticated users
| > >> >> > "Doug Knox MS-MVP" wrote:
| > >> >> >
| > >> >> >> The lowest privilge is applied, to my knowledge.
| > >> >> >>
| > >> >> >> --
| > >> >> >> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
| > >> >> >> Win 95/98/Me/XP Tweaks and Fixes
| > >> >> >> http://www.dougknox.com
| > >> >> >> --------------------------------
| > >> >> >> Per user Group Policy Restrictions for XP Home and XP Pro
| > >> >> >> http://www.dougknox.com/xp/utils/x [...] onsole.htm
| > >> >> >> --------------------------------
| > >> >> >> Please reply only to the newsgroup so all may benefit.
| > >> >> >> Unsolicited e-mail is not answered.
| > >> >> >>
| > >> >> >> "BookerW" <BookerW@discussions.microsoft.com> wrote in message
news:2F4B98D2-4C4C-4BDD-AFB0-3618B5455096@microsoft.com...
| > >> >> >> > Does one group take precedence over the other. I had a situation where the
| > >> >> >> > user's accoutn was in both groups but when trying to install software, it
| > >> >> >> > appeared as if he did not have enough privileges. One of my technicians
| > >> >> >> > signed in as administrator and was able to install the software without a
| > >> >> >> > problem. When he signed in as the user who was in both Power Users and
| > >> >> >> > Admins, he said the install did not work.
| > >> >> >> >
| > >> >> >> > So the general question is how does Windows decide how to apply group
| > >> >> >> > membership roles.
| > >> >> >>
| > >> >>
| > >>
| >
| >
| >