Domain users

Archived from groups: microsoft.public.win2000.group_policy (More info?)

I just set up a Domain using Windows 2000 Advance Server SP3 as the Domain Controller. I have a Windows
XP client. They use a logon to the domain that I have in Windows 2K as a Domain User. But in Windows XP I
am finding much that is denied to the user. They needed to install an Updated Windows Messenger and doing so
Error Access denied. Now I'd like to keep the logon in Doman Users but I'd like them to have at least some
modicum of istall priviledges. Can you tell me how this is done in a domain setting or maybe suggest a Microsoft
white paper that discusses how to set up Group Policy so what I want can happen? Thanks.

--
George Hester
_________________________________
12 answers Last reply
More about domain users
  1. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    As long as the installs are .msi packages [ Windows Installer Package] or
    can be converted to .msi packages you can use Group Policy to assign or
    publish software to users or assign software to computers. If you have
    updates from Windows Updates that are considered critical updates, they can
    be installed using Automatic Updates install by schedule option which does
    not require that the user be local administrator. See the link below for
    more info on using Group Policy to manage software installs which basically
    involves creating a share called a software distribution point where you put
    the .msi packages you want to deploy and then configuring Group Policy so
    that the proper users or computers have access to the .msi packages which
    can be installed automatically, show in add and remove programs, show as a
    desktop shortcut, or are installed first time a user tries to access
    associated file such as a .doc file which would install Word. --- Steve

    http://www.microsoft.com/windows2000/techinfo/planning/management/swinstall.asp

    "George Hester" <hesterloli@hotmail.com> wrote in message
    news:OTUhEwb1EHA.1860@TK2MSFTNGP15.phx.gbl...
    I just set up a Domain using Windows 2000 Advance Server SP3 as the Domain
    Controller. I have a Windows
    XP client. They use a logon to the domain that I have in Windows 2K as a
    Domain User. But in Windows XP I
    am finding much that is denied to the user. They needed to install an
    Updated Windows Messenger and doing so
    Error Access denied. Now I'd like to keep the logon in Doman Users but I'd
    like them to have at least some
    modicum of istall priviledges. Can you tell me how this is done in a domain
    setting or maybe suggest a Microsoft
    white paper that discusses how to set up Group Policy so what I want can
    happen? Thanks.

    --
    George Hester
    _________________________________
  2. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    Hmmm. Well actually I dont't know what the install file type is. The XP user wanted to use Windows Messenger in Windows XP. Doing so we were faced with a update message. We at first said, 'No" and that was the end of Windows Messenger. So we diecided to say, "yes." Installation Denied.

    So I guess there is no way to allow a user in a Domain to install anything on their machines? Great.

    --
    George Hester
    ________________________________
    "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message news:6Awqd.579942$mD.423479@attbi_s02...
    > As long as the installs are .msi packages [ Windows Installer Package] or
    > can be converted to .msi packages you can use Group Policy to assign or
    > publish software to users or assign software to computers. If you have
    > updates from Windows Updates that are considered critical updates, they can
    > be installed using Automatic Updates install by schedule option which does
    > not require that the user be local administrator. See the link below for
    > more info on using Group Policy to manage software installs which basically
    > involves creating a share called a software distribution point where you put
    > the .msi packages you want to deploy and then configuring Group Policy so
    > that the proper users or computers have access to the .msi packages which
    > can be installed automatically, show in add and remove programs, show as a
    > desktop shortcut, or are installed first time a user tries to access
    > associated file such as a .doc file which would install Word. --- Steve
    >
    > http://www.microsoft.com/windows2000/techinfo/planning/management/swinstall.asp
    >
    > "George Hester" <hesterloli@hotmail.com> wrote in message
    > news:OTUhEwb1EHA.1860@TK2MSFTNGP15.phx.gbl...
    > I just set up a Domain using Windows 2000 Advance Server SP3 as the Domain
    > Controller. I have a Windows
    > XP client. They use a logon to the domain that I have in Windows 2K as a
    > Domain User. But in Windows XP I
    > am finding much that is denied to the user. They needed to install an
    > Updated Windows Messenger and doing so
    > Error Access denied. Now I'd like to keep the logon in Doman Users but I'd
    > like them to have at least some
    > modicum of istall priviledges. Can you tell me how this is done in a domain
    > setting or maybe suggest a Microsoft
    > white paper that discusses how to set up Group Policy so what I want can
    > happen? Thanks.
    >
    > --
    > George Hester
    > _________________________________
    >
    >
  3. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    As a regular user they will not be able to install much of anything. If
    Group Policy software installation does not work for you, try adding the
    domain users account to the power users group on their local machine which
    may allow them to install the software without being a local
    administrator. --- Steve


    "George Hester" <hesterloli@hotmail.com> wrote in message
    news:uEdxXAe1EHA.3448@TK2MSFTNGP09.phx.gbl...
    Hmmm. Well actually I dont't know what the install file type is. The XP
    user wanted to use Windows Messenger in Windows XP. Doing so we were faced
    with a update message. We at first said, 'No" and that was the end of
    Windows Messenger. So we diecided to say, "yes." Installation Denied.

    So I guess there is no way to allow a user in a Domain to install anything
    on their machines? Great.

    --
    George Hester
    ________________________________
    "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    news:6Awqd.579942$mD.423479@attbi_s02...
    > As long as the installs are .msi packages [ Windows Installer Package] or
    > can be converted to .msi packages you can use Group Policy to assign or
    > publish software to users or assign software to computers. If you have
    > updates from Windows Updates that are considered critical updates, they
    > can
    > be installed using Automatic Updates install by schedule option which does
    > not require that the user be local administrator. See the link below for
    > more info on using Group Policy to manage software installs which
    > basically
    > involves creating a share called a software distribution point where you
    > put
    > the .msi packages you want to deploy and then configuring Group Policy so
    > that the proper users or computers have access to the .msi packages which
    > can be installed automatically, show in add and remove programs, show as a
    > desktop shortcut, or are installed first time a user tries to access
    > associated file such as a .doc file which would install Word. --- Steve
    >
    > http://www.microsoft.com/windows2000/techinfo/planning/management/swinstall.asp
    >
    > "George Hester" <hesterloli@hotmail.com> wrote in message
    > news:OTUhEwb1EHA.1860@TK2MSFTNGP15.phx.gbl...
    > I just set up a Domain using Windows 2000 Advance Server SP3 as the Domain
    > Controller. I have a Windows
    > XP client. They use a logon to the domain that I have in Windows 2K as a
    > Domain User. But in Windows XP I
    > am finding much that is denied to the user. They needed to install an
    > Updated Windows Messenger and doing so
    > Error Access denied. Now I'd like to keep the logon in Doman Users but
    > I'd
    > like them to have at least some
    > modicum of istall priviledges. Can you tell me how this is done in a
    > domain
    > setting or maybe suggest a Microsoft
    > white paper that discusses how to set up Group Policy so what I want can
    > happen? Thanks.
    >
    > --
    > George Hester
    > _________________________________
    >
    >
  4. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    Thanks I'll see what can be done in that regard. Actually I don't want them
    to be able to install much it's either everything or nothing it seems.

    --
    George Hester
    _________________________________
    "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    news:2PIqd.174658$R05.91402@attbi_s53...
    > As a regular user they will not be able to install much of anything. If
    > Group Policy software installation does not work for you, try adding the
    > domain users account to the power users group on their local machine which
    > may allow them to install the software without being a local
    > administrator. --- Steve
    >
    >
    > "George Hester" <hesterloli@hotmail.com> wrote in message
    > news:uEdxXAe1EHA.3448@TK2MSFTNGP09.phx.gbl...
    > Hmmm. Well actually I dont't know what the install file type is. The XP
    > user wanted to use Windows Messenger in Windows XP. Doing so we were
    faced
    > with a update message. We at first said, 'No" and that was the end of
    > Windows Messenger. So we diecided to say, "yes." Installation Denied.
    >
    > So I guess there is no way to allow a user in a Domain to install anything
    > on their machines? Great.
    >
    > --
    > George Hester
    > ________________________________
    > "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    > news:6Awqd.579942$mD.423479@attbi_s02...
    > > As long as the installs are .msi packages [ Windows Installer Package]
    or
    > > can be converted to .msi packages you can use Group Policy to assign or
    > > publish software to users or assign software to computers. If you have
    > > updates from Windows Updates that are considered critical updates, they
    > > can
    > > be installed using Automatic Updates install by schedule option which
    does
    > > not require that the user be local administrator. See the link below for
    > > more info on using Group Policy to manage software installs which
    > > basically
    > > involves creating a share called a software distribution point where you
    > > put
    > > the .msi packages you want to deploy and then configuring Group Policy
    so
    > > that the proper users or computers have access to the .msi packages
    which
    > > can be installed automatically, show in add and remove programs, show as
    a
    > > desktop shortcut, or are installed first time a user tries to access
    > > associated file such as a .doc file which would install Word. --- Steve
    > >
    > >
    http://www.microsoft.com/windows2000/techinfo/planning/management/swinstall.
    asp
    > >
    > > "George Hester" <hesterloli@hotmail.com> wrote in message
    > > news:OTUhEwb1EHA.1860@TK2MSFTNGP15.phx.gbl...
    > > I just set up a Domain using Windows 2000 Advance Server SP3 as the
    Domain
    > > Controller. I have a Windows
    > > XP client. They use a logon to the domain that I have in Windows 2K as
    a
    > > Domain User. But in Windows XP I
    > > am finding much that is denied to the user. They needed to install an
    > > Updated Windows Messenger and doing so
    > > Error Access denied. Now I'd like to keep the logon in Doman Users but
    > > I'd
    > > like them to have at least some
    > > modicum of istall priviledges. Can you tell me how this is done in a
    > > domain
    > > setting or maybe suggest a Microsoft
    > > white paper that discusses how to set up Group Policy so what I want can
    > > happen? Thanks.
    > >
    > > --
    > > George Hester
    > > _________________________________
    > >
    > >
    >
    >
  5. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    Hi Steve. I think I got it. See I called the user on the Windows XP the
    same name as I called it in the Domain Windows 2000 ADV Server. But signing
    in on either of those two resulted in access denied issues even though the
    local user in XP was part of the Administrators group. It turns out I had
    this wrong but I can tell you the wizards in XP did not help. The reason
    being when I tried Locations to point to the domain I was only getting local
    groups on the Local machine. I have still not figured out how to get the
    groups in the domain to show on the client. But instead what I did is just
    type it in domain\user in XP. That worked. So now I have a user in the
    domain who has Admin rights on the client. That is just a DoimainUser.
    Nothing more. But the user is an Admin on the Local machine Windows XP.
    That's good enough for what I wanted to do right now. I still would like to
    get a list of the Groups in the domain on the client but that's just not
    happening. It was a cinch in Windows 98.

    --
    George Hester
    _________________________________
    "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    news:2PIqd.174658$R05.91402@attbi_s53...
    > As a regular user they will not be able to install much of anything. If
    > Group Policy software installation does not work for you, try adding the
    > domain users account to the power users group on their local machine which
    > may allow them to install the software without being a local
    > administrator. --- Steve
    >
    >
    > "George Hester" <hesterloli@hotmail.com> wrote in message
    > news:uEdxXAe1EHA.3448@TK2MSFTNGP09.phx.gbl...
    > Hmmm. Well actually I dont't know what the install file type is. The XP
    > user wanted to use Windows Messenger in Windows XP. Doing so we were
    faced
    > with a update message. We at first said, 'No" and that was the end of
    > Windows Messenger. So we diecided to say, "yes." Installation Denied.
    >
    > So I guess there is no way to allow a user in a Domain to install anything
    > on their machines? Great.
    >
    > --
    > George Hester
    > ________________________________
    > "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    > news:6Awqd.579942$mD.423479@attbi_s02...
    > > As long as the installs are .msi packages [ Windows Installer Package]
    or
    > > can be converted to .msi packages you can use Group Policy to assign or
    > > publish software to users or assign software to computers. If you have
    > > updates from Windows Updates that are considered critical updates, they
    > > can
    > > be installed using Automatic Updates install by schedule option which
    does
    > > not require that the user be local administrator. See the link below for
    > > more info on using Group Policy to manage software installs which
    > > basically
    > > involves creating a share called a software distribution point where you
    > > put
    > > the .msi packages you want to deploy and then configuring Group Policy
    so
    > > that the proper users or computers have access to the .msi packages
    which
    > > can be installed automatically, show in add and remove programs, show as
    a
    > > desktop shortcut, or are installed first time a user tries to access
    > > associated file such as a .doc file which would install Word. --- Steve
    > >
    > >
    http://www.microsoft.com/windows2000/techinfo/planning/management/swinstall.
    asp
    > >
    > > "George Hester" <hesterloli@hotmail.com> wrote in message
    > > news:OTUhEwb1EHA.1860@TK2MSFTNGP15.phx.gbl...
    > > I just set up a Domain using Windows 2000 Advance Server SP3 as the
    Domain
    > > Controller. I have a Windows
    > > XP client. They use a logon to the domain that I have in Windows 2K as
    a
    > > Domain User. But in Windows XP I
    > > am finding much that is denied to the user. They needed to install an
    > > Updated Windows Messenger and doing so
    > > Error Access denied. Now I'd like to keep the logon in Doman Users but
    > > I'd
    > > like them to have at least some
    > > modicum of istall priviledges. Can you tell me how this is done in a
    > > domain
    > > setting or maybe suggest a Microsoft
    > > white paper that discusses how to set up Group Policy so what I want can
    > > happen? Thanks.
    > >
    > > --
    > > George Hester
    > > _________________________________
    > >
    > >
    >
    >
  6. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    The procedure to add groups is a bit different for XP that W2K for sure.
    When you try to add a group you will see a box for "locations" where you
    should be able to select the domain. It may help to make sure you logon to
    the computer as a domain user when you try to do such. If you have tried
    this and do not see the domain in the locations make sure your dns
    configuration is correct in the domain, in that the first domain controller
    point only to itself as it's preferred dns server and as shown by ipconfig
    /all and that the other domain controllers point to the first domain
    controller and then themselves as their preferred dns server. Domain client
    operating systems W2K and XP Pro MUST point only to Active Directory domain
    controllers as their preferred dns server. Also use the support tool netdiag
    on first the domain controller and then your XP Pro domain computer to make
    sure no errors are reported for dns, dc discovery, trust/secure channel, or
    kerberos. Problems such as those could cause the domain groups to not show
    in the list of available groups on your domain computer. --- Steve

    http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B291382 -- AD
    dns FAQ.
    http://www.microsoft.com/downloads/details.aspx?familyid=aae64b62-27c0-4523-8af9-66a968a8c942&displaylang=en
    -- netdiag.

    "George Hester" <hesterloli@hotmail.com> wrote in message
    news:uL1cRDp1EHA.2624@TK2MSFTNGP11.phx.gbl...
    > Hi Steve. I think I got it. See I called the user on the Windows XP the
    > same name as I called it in the Domain Windows 2000 ADV Server. But
    > signing
    > in on either of those two resulted in access denied issues even though the
    > local user in XP was part of the Administrators group. It turns out I had
    > this wrong but I can tell you the wizards in XP did not help. The reason
    > being when I tried Locations to point to the domain I was only getting
    > local
    > groups on the Local machine. I have still not figured out how to get the
    > groups in the domain to show on the client. But instead what I did is
    > just
    > type it in domain\user in XP. That worked. So now I have a user in the
    > domain who has Admin rights on the client. That is just a DoimainUser.
    > Nothing more. But the user is an Admin on the Local machine Windows XP.
    > That's good enough for what I wanted to do right now. I still would like
    > to
    > get a list of the Groups in the domain on the client but that's just not
    > happening. It was a cinch in Windows 98.
    >
    > --
    > George Hester
    > _________________________________
    > "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    > news:2PIqd.174658$R05.91402@attbi_s53...
    >> As a regular user they will not be able to install much of anything. If
    >> Group Policy software installation does not work for you, try adding the
    >> domain users account to the power users group on their local machine
    >> which
    >> may allow them to install the software without being a local
    >> administrator. --- Steve
    >>
    >>
    >> "George Hester" <hesterloli@hotmail.com> wrote in message
    >> news:uEdxXAe1EHA.3448@TK2MSFTNGP09.phx.gbl...
    >> Hmmm. Well actually I dont't know what the install file type is. The XP
    >> user wanted to use Windows Messenger in Windows XP. Doing so we were
    > faced
    >> with a update message. We at first said, 'No" and that was the end of
    >> Windows Messenger. So we diecided to say, "yes." Installation Denied.
    >>
    >> So I guess there is no way to allow a user in a Domain to install
    >> anything
    >> on their machines? Great.
    >>
    >> --
    >> George Hester
    >> ________________________________
    >> "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    >> news:6Awqd.579942$mD.423479@attbi_s02...
    >> > As long as the installs are .msi packages [ Windows Installer Package]
    > or
    >> > can be converted to .msi packages you can use Group Policy to assign or
    >> > publish software to users or assign software to computers. If you have
    >> > updates from Windows Updates that are considered critical updates, they
    >> > can
    >> > be installed using Automatic Updates install by schedule option which
    > does
    >> > not require that the user be local administrator. See the link below
    >> > for
    >> > more info on using Group Policy to manage software installs which
    >> > basically
    >> > involves creating a share called a software distribution point where
    >> > you
    >> > put
    >> > the .msi packages you want to deploy and then configuring Group Policy
    > so
    >> > that the proper users or computers have access to the .msi packages
    > which
    >> > can be installed automatically, show in add and remove programs, show
    >> > as
    > a
    >> > desktop shortcut, or are installed first time a user tries to access
    >> > associated file such as a .doc file which would install Word. --- Steve
    >> >
    >> >
    > http://www.microsoft.com/windows2000/techinfo/planning/management/swinstall.
    > asp
    >> >
    >> > "George Hester" <hesterloli@hotmail.com> wrote in message
    >> > news:OTUhEwb1EHA.1860@TK2MSFTNGP15.phx.gbl...
    >> > I just set up a Domain using Windows 2000 Advance Server SP3 as the
    > Domain
    >> > Controller. I have a Windows
    >> > XP client. They use a logon to the domain that I have in Windows 2K as
    > a
    >> > Domain User. But in Windows XP I
    >> > am finding much that is denied to the user. They needed to install an
    >> > Updated Windows Messenger and doing so
    >> > Error Access denied. Now I'd like to keep the logon in Doman Users but
    >> > I'd
    >> > like them to have at least some
    >> > modicum of istall priviledges. Can you tell me how this is done in a
    >> > domain
    >> > setting or maybe suggest a Microsoft
    >> > white paper that discusses how to set up Group Policy so what I want
    >> > can
    >> > happen? Thanks.
    >> >
    >> > --
    >> > George Hester
    >> > _________________________________
    >> >
    >> >
    >>
    >>
    >
    >
  7. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    Thanks Steve I think you provided the answer to my issues. I have Domain issues off and on. Works fine one moment not the next. I am going to follow your comments to the letter and see if I can't get this thing behaving right.

    --
    George Hester
    _________________________________
    "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message news:x2Tqd.177043$R05.112694@attbi_s53...
    > The procedure to add groups is a bit different for XP that W2K for sure.
    > When you try to add a group you will see a box for "locations" where you
    > should be able to select the domain. It may help to make sure you logon to
    > the computer as a domain user when you try to do such. If you have tried
    > this and do not see the domain in the locations make sure your dns
    > configuration is correct in the domain, in that the first domain controller
    > point only to itself as it's preferred dns server and as shown by ipconfig
    > /all and that the other domain controllers point to the first domain
    > controller and then themselves as their preferred dns server. Domain client
    > operating systems W2K and XP Pro MUST point only to Active Directory domain
    > controllers as their preferred dns server. Also use the support tool netdiag
    > on first the domain controller and then your XP Pro domain computer to make
    > sure no errors are reported for dns, dc discovery, trust/secure channel, or
    > kerberos. Problems such as those could cause the domain groups to not show
    > in the list of available groups on your domain computer. --- Steve
    >
    > http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B291382 -- AD
    > dns FAQ.
    > http://www.microsoft.com/downloads/details.aspx?familyid=aae64b62-27c0-4523-8af9-66a968a8c942&displaylang=en
    > -- netdiag.
    >
    > "George Hester" <hesterloli@hotmail.com> wrote in message
    > news:uL1cRDp1EHA.2624@TK2MSFTNGP11.phx.gbl...
    > > Hi Steve. I think I got it. See I called the user on the Windows XP the
    > > same name as I called it in the Domain Windows 2000 ADV Server. But
    > > signing
    > > in on either of those two resulted in access denied issues even though the
    > > local user in XP was part of the Administrators group. It turns out I had
    > > this wrong but I can tell you the wizards in XP did not help. The reason
    > > being when I tried Locations to point to the domain I was only getting
    > > local
    > > groups on the Local machine. I have still not figured out how to get the
    > > groups in the domain to show on the client. But instead what I did is
    > > just
    > > type it in domain\user in XP. That worked. So now I have a user in the
    > > domain who has Admin rights on the client. That is just a DoimainUser.
    > > Nothing more. But the user is an Admin on the Local machine Windows XP.
    > > That's good enough for what I wanted to do right now. I still would like
    > > to
    > > get a list of the Groups in the domain on the client but that's just not
    > > happening. It was a cinch in Windows 98.
    > >
    > > --
    > > George Hester
    > > _________________________________
    > > "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    > > news:2PIqd.174658$R05.91402@attbi_s53...
    > >> As a regular user they will not be able to install much of anything. If
    > >> Group Policy software installation does not work for you, try adding the
    > >> domain users account to the power users group on their local machine
    > >> which
    > >> may allow them to install the software without being a local
    > >> administrator. --- Steve
    > >>
    > >>
    > >> "George Hester" <hesterloli@hotmail.com> wrote in message
    > >> news:uEdxXAe1EHA.3448@TK2MSFTNGP09.phx.gbl...
    > >> Hmmm. Well actually I dont't know what the install file type is. The XP
    > >> user wanted to use Windows Messenger in Windows XP. Doing so we were
    > > faced
    > >> with a update message. We at first said, 'No" and that was the end of
    > >> Windows Messenger. So we diecided to say, "yes." Installation Denied.
    > >>
    > >> So I guess there is no way to allow a user in a Domain to install
    > >> anything
    > >> on their machines? Great.
    > >>
    > >> --
    > >> George Hester
    > >> ________________________________
    > >> "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    > >> news:6Awqd.579942$mD.423479@attbi_s02...
    > >> > As long as the installs are .msi packages [ Windows Installer Package]
    > > or
    > >> > can be converted to .msi packages you can use Group Policy to assign or
    > >> > publish software to users or assign software to computers. If you have
    > >> > updates from Windows Updates that are considered critical updates, they
    > >> > can
    > >> > be installed using Automatic Updates install by schedule option which
    > > does
    > >> > not require that the user be local administrator. See the link below
    > >> > for
    > >> > more info on using Group Policy to manage software installs which
    > >> > basically
    > >> > involves creating a share called a software distribution point where
    > >> > you
    > >> > put
    > >> > the .msi packages you want to deploy and then configuring Group Policy
    > > so
    > >> > that the proper users or computers have access to the .msi packages
    > > which
    > >> > can be installed automatically, show in add and remove programs, show
    > >> > as
    > > a
    > >> > desktop shortcut, or are installed first time a user tries to access
    > >> > associated file such as a .doc file which would install Word. --- Steve
    > >> >
    > >> >
    > > http://www.microsoft.com/windows2000/techinfo/planning/management/swinstall.
    > > asp
    > >> >
    > >> > "George Hester" <hesterloli@hotmail.com> wrote in message
    > >> > news:OTUhEwb1EHA.1860@TK2MSFTNGP15.phx.gbl...
    > >> > I just set up a Domain using Windows 2000 Advance Server SP3 as the
    > > Domain
    > >> > Controller. I have a Windows
    > >> > XP client. They use a logon to the domain that I have in Windows 2K as
    > > a
    > >> > Domain User. But in Windows XP I
    > >> > am finding much that is denied to the user. They needed to install an
    > >> > Updated Windows Messenger and doing so
    > >> > Error Access denied. Now I'd like to keep the logon in Doman Users but
    > >> > I'd
    > >> > like them to have at least some
    > >> > modicum of istall priviledges. Can you tell me how this is done in a
    > >> > domain
    > >> > setting or maybe suggest a Microsoft
    > >> > white paper that discusses how to set up Group Policy so what I want
    > >> > can
    > >> > happen? Thanks.
    > >> >
    > >> > --
    > >> > George Hester
    > >> > _________________________________
    > >> >
    > >> >
    > >>
    > >>
    > >
    > >
    >
    >
  8. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    Yeah buddy. I think you got it. I really don't think this is as hard as it looks at first. I'm new to this and so
    even though something works it may not be the right thing. Then after a while when it isn't, ISSUES start to
    appear. And believe me I had (have) ISSUES.

    I knew what to do after you said what you said and I went ahead and did it. I put the Windows XP client at its
    static IP address (that is provided by the Router) and set its TCP\IP properties to look to my Domain Controller
    for the DNS Server. All done in the Local Administrator account of course after I put everything back to
    WORKGROUP properties.

    It's funny because all the icons chnaged after I put it in the Domain. I had real icons signifying various Domain
    properties whereas before I think I had a mixture of WORKGROUP and Domain icons.

    Now when I go to Locations... I see Entire Directory not the Local Machine's name. So I think that's right. It
    wasn't all for nought though. The Domain users I had in it when it wasn't right are still OK and the one I set as a
    User in the Domain and an Administrator in Windows XP still has all its Properties. Thanks Microsoft and you too Steve.

    Now I just got to get that dang USB Printer on the Domain Server to work in the client....

    --
    George Hester
    _________________________________
    "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message news:x2Tqd.177043$R05.112694@attbi_s53...
    > The procedure to add groups is a bit different for XP that W2K for sure.
    > When you try to add a group you will see a box for "locations" where you
    > should be able to select the domain. It may help to make sure you logon to
    > the computer as a domain user when you try to do such. If you have tried
    > this and do not see the domain in the locations make sure your dns
    > configuration is correct in the domain, in that the first domain controller
    > point only to itself as it's preferred dns server and as shown by ipconfig
    > /all and that the other domain controllers point to the first domain
    > controller and then themselves as their preferred dns server. Domain client
    > operating systems W2K and XP Pro MUST point only to Active Directory domain
    > controllers as their preferred dns server. Also use the support tool netdiag
    > on first the domain controller and then your XP Pro domain computer to make
    > sure no errors are reported for dns, dc discovery, trust/secure channel, or
    > kerberos. Problems such as those could cause the domain groups to not show
    > in the list of available groups on your domain computer. --- Steve
    >
    > http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B291382 -- AD
    > dns FAQ.
    > http://www.microsoft.com/downloads/details.aspx?familyid=aae64b62-27c0-4523-8af9-66a968a8c942&displaylang=en
    > -- netdiag.
    >
    > "George Hester" <hesterloli@hotmail.com> wrote in message
    > news:uL1cRDp1EHA.2624@TK2MSFTNGP11.phx.gbl...
    > > Hi Steve. I think I got it. See I called the user on the Windows XP the
    > > same name as I called it in the Domain Windows 2000 ADV Server. But
    > > signing
    > > in on either of those two resulted in access denied issues even though the
    > > local user in XP was part of the Administrators group. It turns out I had
    > > this wrong but I can tell you the wizards in XP did not help. The reason
    > > being when I tried Locations to point to the domain I was only getting
    > > local
    > > groups on the Local machine. I have still not figured out how to get the
    > > groups in the domain to show on the client. But instead what I did is
    > > just
    > > type it in domain\user in XP. That worked. So now I have a user in the
    > > domain who has Admin rights on the client. That is just a DoimainUser.
    > > Nothing more. But the user is an Admin on the Local machine Windows XP.
    > > That's good enough for what I wanted to do right now. I still would like
    > > to
    > > get a list of the Groups in the domain on the client but that's just not
    > > happening. It was a cinch in Windows 98.
    > >
    > > --
    > > George Hester
    > > _________________________________
    > > "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    > > news:2PIqd.174658$R05.91402@attbi_s53...
    > >> As a regular user they will not be able to install much of anything. If
    > >> Group Policy software installation does not work for you, try adding the
    > >> domain users account to the power users group on their local machine
    > >> which
    > >> may allow them to install the software without being a local
    > >> administrator. --- Steve
    > >>
    > >>
    > >> "George Hester" <hesterloli@hotmail.com> wrote in message
    > >> news:uEdxXAe1EHA.3448@TK2MSFTNGP09.phx.gbl...
    > >> Hmmm. Well actually I dont't know what the install file type is. The XP
    > >> user wanted to use Windows Messenger in Windows XP. Doing so we were
    > > faced
    > >> with a update message. We at first said, 'No" and that was the end of
    > >> Windows Messenger. So we diecided to say, "yes." Installation Denied.
    > >>
    > >> So I guess there is no way to allow a user in a Domain to install
    > >> anything
    > >> on their machines? Great.
    > >>
    > >> --
    > >> George Hester
    > >> ________________________________
    > >> "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    > >> news:6Awqd.579942$mD.423479@attbi_s02...
    > >> > As long as the installs are .msi packages [ Windows Installer Package]
    > > or
    > >> > can be converted to .msi packages you can use Group Policy to assign or
    > >> > publish software to users or assign software to computers. If you have
    > >> > updates from Windows Updates that are considered critical updates, they
    > >> > can
    > >> > be installed using Automatic Updates install by schedule option which
    > > does
    > >> > not require that the user be local administrator. See the link below
    > >> > for
    > >> > more info on using Group Policy to manage software installs which
    > >> > basically
    > >> > involves creating a share called a software distribution point where
    > >> > you
    > >> > put
    > >> > the .msi packages you want to deploy and then configuring Group Policy
    > > so
    > >> > that the proper users or computers have access to the .msi packages
    > > which
    > >> > can be installed automatically, show in add and remove programs, show
    > >> > as
    > > a
    > >> > desktop shortcut, or are installed first time a user tries to access
    > >> > associated file such as a .doc file which would install Word. --- Steve
    > >> >
    > >> >
    > > http://www.microsoft.com/windows2000/techinfo/planning/management/swinstall.
    > > asp
    > >> >
    > >> > "George Hester" <hesterloli@hotmail.com> wrote in message
    > >> > news:OTUhEwb1EHA.1860@TK2MSFTNGP15.phx.gbl...
    > >> > I just set up a Domain using Windows 2000 Advance Server SP3 as the
    > > Domain
    > >> > Controller. I have a Windows
    > >> > XP client. They use a logon to the domain that I have in Windows 2K as
    > > a
    > >> > Domain User. But in Windows XP I
    > >> > am finding much that is denied to the user. They needed to install an
    > >> > Updated Windows Messenger and doing so
    > >> > Error Access denied. Now I'd like to keep the logon in Doman Users but
    > >> > I'd
    > >> > like them to have at least some
    > >> > modicum of istall priviledges. Can you tell me how this is done in a
    > >> > domain
    > >> > setting or maybe suggest a Microsoft
    > >> > white paper that discusses how to set up Group Policy so what I want
    > >> > can
    > >> > happen? Thanks.
    > >> >
    > >> > --
    > >> > George Hester
    > >> > _________________________________
    > >> >
    > >> >
    > >>
    > >>
    > >
    > >
    >
    >
  9. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    Ok George. It sounds like you are making good progress. Proper dns
    configuration is a must in an Active Directory domain. I think you will find
    things in general work better now. --- Steve

    "George Hester" <hesterloli@hotmail.com> wrote in message
    news:%23uIwYsx1EHA.3840@tk2msftngp13.phx.gbl...
    Yeah buddy. I think you got it. I really don't think this is as hard as it
    looks at first. I'm new to this and so
    even though something works it may not be the right thing. Then after a
    while when it isn't, ISSUES start to
    appear. And believe me I had (have) ISSUES.

    I knew what to do after you said what you said and I went ahead and did it.
    I put the Windows XP client at its
    static IP address (that is provided by the Router) and set its TCP\IP
    properties to look to my Domain Controller
    for the DNS Server. All done in the Local Administrator account of course
    after I put everything back to
    WORKGROUP properties.

    It's funny because all the icons chnaged after I put it in the Domain. I
    had real icons signifying various Domain
    properties whereas before I think I had a mixture of WORKGROUP and Domain
    icons.

    Now when I go to Locations... I see Entire Directory not the Local Machine's
    name. So I think that's right. It
    wasn't all for nought though. The Domain users I had in it when it wasn't
    right are still OK and the one I set as a
    User in the Domain and an Administrator in Windows XP still has all its
    Properties. Thanks Microsoft and you too Steve.

    Now I just got to get that dang USB Printer on the Domain Server to work in
    the client....

    --
    George Hester
    _________________________________
    "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    news:x2Tqd.177043$R05.112694@attbi_s53...
    > The procedure to add groups is a bit different for XP that W2K for sure.
    > When you try to add a group you will see a box for "locations" where you
    > should be able to select the domain. It may help to make sure you logon to
    > the computer as a domain user when you try to do such. If you have tried
    > this and do not see the domain in the locations make sure your dns
    > configuration is correct in the domain, in that the first domain
    > controller
    > point only to itself as it's preferred dns server and as shown by
    > ipconfig
    > /all and that the other domain controllers point to the first domain
    > controller and then themselves as their preferred dns server. Domain
    > client
    > operating systems W2K and XP Pro MUST point only to Active Directory
    > domain
    > controllers as their preferred dns server. Also use the support tool
    > netdiag
    > on first the domain controller and then your XP Pro domain computer to
    > make
    > sure no errors are reported for dns, dc discovery, trust/secure channel,
    > or
    > kerberos. Problems such as those could cause the domain groups to not show
    > in the list of available groups on your domain computer. --- Steve
    >
    > http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B291382 -- AD
    > dns FAQ.
    > http://www.microsoft.com/downloads/details.aspx?familyid=aae64b62-27c0-4523-8af9-66a968a8c942&displaylang=en
    > -- netdiag.
    >
    > "George Hester" <hesterloli@hotmail.com> wrote in message
    > news:uL1cRDp1EHA.2624@TK2MSFTNGP11.phx.gbl...
    > > Hi Steve. I think I got it. See I called the user on the Windows XP
    > > the
    > > same name as I called it in the Domain Windows 2000 ADV Server. But
    > > signing
    > > in on either of those two resulted in access denied issues even though
    > > the
    > > local user in XP was part of the Administrators group. It turns out I
    > > had
    > > this wrong but I can tell you the wizards in XP did not help. The
    > > reason
    > > being when I tried Locations to point to the domain I was only getting
    > > local
    > > groups on the Local machine. I have still not figured out how to get
    > > the
    > > groups in the domain to show on the client. But instead what I did is
    > > just
    > > type it in domain\user in XP. That worked. So now I have a user in the
    > > domain who has Admin rights on the client. That is just a DoimainUser.
    > > Nothing more. But the user is an Admin on the Local machine Windows XP.
    > > That's good enough for what I wanted to do right now. I still would
    > > like
    > > to
    > > get a list of the Groups in the domain on the client but that's just not
    > > happening. It was a cinch in Windows 98.
    > >
    > > --
    > > George Hester
    > > _________________________________
    > > "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    > > news:2PIqd.174658$R05.91402@attbi_s53...
    > >> As a regular user they will not be able to install much of anything. If
    > >> Group Policy software installation does not work for you, try adding
    > >> the
    > >> domain users account to the power users group on their local machine
    > >> which
    > >> may allow them to install the software without being a local
    > >> administrator. --- Steve
    > >>
    > >>
    > >> "George Hester" <hesterloli@hotmail.com> wrote in message
    > >> news:uEdxXAe1EHA.3448@TK2MSFTNGP09.phx.gbl...
    > >> Hmmm. Well actually I dont't know what the install file type is. The
    > >> XP
    > >> user wanted to use Windows Messenger in Windows XP. Doing so we were
    > > faced
    > >> with a update message. We at first said, 'No" and that was the end of
    > >> Windows Messenger. So we diecided to say, "yes." Installation Denied.
    > >>
    > >> So I guess there is no way to allow a user in a Domain to install
    > >> anything
    > >> on their machines? Great.
    > >>
    > >> --
    > >> George Hester
    > >> ________________________________
    > >> "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    > >> news:6Awqd.579942$mD.423479@attbi_s02...
    > >> > As long as the installs are .msi packages [ Windows Installer
    > >> > Package]
    > > or
    > >> > can be converted to .msi packages you can use Group Policy to assign
    > >> > or
    > >> > publish software to users or assign software to computers. If you
    > >> > have
    > >> > updates from Windows Updates that are considered critical updates,
    > >> > they
    > >> > can
    > >> > be installed using Automatic Updates install by schedule option which
    > > does
    > >> > not require that the user be local administrator. See the link below
    > >> > for
    > >> > more info on using Group Policy to manage software installs which
    > >> > basically
    > >> > involves creating a share called a software distribution point where
    > >> > you
    > >> > put
    > >> > the .msi packages you want to deploy and then configuring Group
    > >> > Policy
    > > so
    > >> > that the proper users or computers have access to the .msi packages
    > > which
    > >> > can be installed automatically, show in add and remove programs, show
    > >> > as
    > > a
    > >> > desktop shortcut, or are installed first time a user tries to access
    > >> > associated file such as a .doc file which would install Word. ---
    > >> > Steve
    > >> >
    > >> >
    > > http://www.microsoft.com/windows2000/techinfo/planning/management/swinstall.
    > > asp
    > >> >
    > >> > "George Hester" <hesterloli@hotmail.com> wrote in message
    > >> > news:OTUhEwb1EHA.1860@TK2MSFTNGP15.phx.gbl...
    > >> > I just set up a Domain using Windows 2000 Advance Server SP3 as the
    > > Domain
    > >> > Controller. I have a Windows
    > >> > XP client. They use a logon to the domain that I have in Windows 2K
    > >> > as
    > > a
    > >> > Domain User. But in Windows XP I
    > >> > am finding much that is denied to the user. They needed to install
    > >> > an
    > >> > Updated Windows Messenger and doing so
    > >> > Error Access denied. Now I'd like to keep the logon in Doman Users
    > >> > but
    > >> > I'd
    > >> > like them to have at least some
    > >> > modicum of istall priviledges. Can you tell me how this is done in a
    > >> > domain
    > >> > setting or maybe suggest a Microsoft
    > >> > white paper that discusses how to set up Group Policy so what I want
    > >> > can
    > >> > happen? Thanks.
    > >> >
    > >> > --
    > >> > George Hester
    > >> > _________________________________
    > >> >
    > >> >
    > >>
    > >>
    > >
    > >
    >
    >
  10. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    Alot better. The domain is not coming and going like it was before. The
    WORKGROUP disappeared from the My Network Places also. Is there any way to
    view and pass to files on the client without making their root a share? And
    vice-versa?

    --
    George Hester
    _________________________________
    "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    news:bv6rd.591409$mD.411458@attbi_s02...
    > Ok George. It sounds like you are making good progress. Proper dns
    > configuration is a must in an Active Directory domain. I think you will
    find
    > things in general work better now. --- Steve
    >
    <snip>
  11. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    As long as you have administrator access to any computer you can use the
    administrative hidden shares if I understand what you want to do. For
    instance use \\computername\c$ in the run box to access remote computer
    hidden administrative share. This assumes that file and print sharing is
    enabled on the target computer. --- Steve


    "George Hester" <hesterloli@hotmail.com> wrote in message
    news:%23jorFE31EHA.1292@TK2MSFTNGP10.phx.gbl...
    > Alot better. The domain is not coming and going like it was before. The
    > WORKGROUP disappeared from the My Network Places also. Is there any way
    > to
    > view and pass to files on the client without making their root a share?
    > And
    > vice-versa?
    >
    > --
    > George Hester
    > _________________________________
    > "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    > news:bv6rd.591409$mD.411458@attbi_s02...
    >> Ok George. It sounds like you are making good progress. Proper dns
    >> configuration is a must in an Active Directory domain. I think you will
    > find
    >> things in general work better now. --- Steve
    >>
    > <snip>
    >
    >
  12. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    Nice. Thanks.

    --
    George Hester
    _________________________________
    "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message news:O5nrd.427471$wV.147562@attbi_s54...
    > As long as you have administrator access to any computer you can use the
    > administrative hidden shares if I understand what you want to do. For
    > instance use \\computername\c$ in the run box to access remote computer
    > hidden administrative share. This assumes that file and print sharing is
    > enabled on the target computer. --- Steve
    >
    >
    > "George Hester" <hesterloli@hotmail.com> wrote in message
    > news:%23jorFE31EHA.1292@TK2MSFTNGP10.phx.gbl...
    > > Alot better. The domain is not coming and going like it was before. The
    > > WORKGROUP disappeared from the My Network Places also. Is there any way
    > > to
    > > view and pass to files on the client without making their root a share?
    > > And
    > > vice-versa?
    > >
    > > --
    > > George Hester
    > > _________________________________
    > > "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
    > > news:bv6rd.591409$mD.411458@attbi_s02...
    > >> Ok George. It sounds like you are making good progress. Proper dns
    > >> configuration is a must in an Active Directory domain. I think you will
    > > find
    > >> things in general work better now. --- Steve
    > >>
    > > <snip>
    > >
    > >
    >
    >
Ask a new question

Read More

Domain Windows XP Windows