Sign in with
Sign up | Sign in
Your question

Users Group

Last response: in Windows XP
Share
September 20, 2005 2:08:02 PM

Archived from groups: microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.security_admin,microsoft.public.windowsxp.general (More info?)

I created an user account abc on Windows XP Prof.
That user abc auto assigned to group Users.

I created a new group called MyUsers.
Then I added group MyUsers to abc and
removed Users group from abc.

Stange thing happen, user account abc still
exist, but its login icon is no longer
display for login. So user abc can't click
his/her icon to login.

Please tell me what I had missed when I created
the new group MyUsers?

Thank Q in advance!

More about : users group

Anonymous
September 20, 2005 2:42:08 PM

Archived from groups: microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.security_admin,microsoft.public.windowsxp.general (More info?)

RC wrote:
> I created an user account abc on Windows XP Prof.
> That user abc auto assigned to group Users.
>
> I created a new group called MyUsers.
> Then I added group MyUsers to abc and
> removed Users group from abc.
>
> Stange thing happen, user account abc still
> exist, but its login icon is no longer
> display for login. So user abc can't click
> his/her icon to login.
>
> Please tell me what I had missed when I created
> the new group MyUsers?
>
> Thank Q in advance!

Why would you want to remove any account from the built-in
Users group? You've just found one of the unintended results of
that action.

Check Local Security Policy. Start -> Run -> Secpol.msc
Navigate to this location:
Computer Configuration\Windows Settings\Local Policies\User
Rights Assignment
Look for "Allow Logon Locally" in the right hand pane.
See the list of groups. The abc account is no longer a member
of a group that has this
right. You can add the MyUsers group to this list but I think
you're going to find yourself with more problems than this.

Nepatsfan
September 20, 2005 4:47:50 PM

Archived from groups: microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.security_admin,microsoft.public.windowsxp.general (More info?)

Nepatsfan wrote:

>
> Why would you want to remove any account from the built-in
> Users group? You've just found one of the unintended results of
> that action.
>
> You can add the MyUsers group to this list but I think
> you're going to find yourself with more problems than this.
>

OK, let me explain why I did that.
I want to created some folders in D: drive (Not C: drive).

folder1 for account abc (my daughter)
folder2 for account xyz (my son)
folder3 for me (administrator).
etc.

By default, whenever you created a folder on D: drive,
it has groups Users, Owner.

So I want folder1 belong to user abc, in MyUsers group.
That's why I took the group Users out from user abc.

I'll do the similar for account xyz in folder2, etc.
Anonymous
September 20, 2005 6:48:20 PM

Archived from groups: microsoft.public.windowsxp.help_and_support,microsoft.public.windowsxp.security_admin,microsoft.public.windowsxp.general (More info?)

RC wrote:
> Nepatsfan wrote:
>
>>
>> Why would you want to remove any account from the built-in
>> Users group? You've just found one of the unintended
>> results of that action.
>>
>> You can add the MyUsers group to this list but I think
>> you're going to find yourself with more problems than this.
>>
>
> OK, let me explain why I did that.
> I want to created some folders in D: drive (Not C: drive).
>
> folder1 for account abc (my daughter)
> folder2 for account xyz (my son)
> folder3 for me (administrator).
> etc.
>
> By default, whenever you created a folder on D: drive,
> it has groups Users, Owner.
>
> So I want folder1 belong to user abc, in MyUsers group.
> That's why I took the group Users out from user abc.
>
> I'll do the similar for account xyz in folder2, etc.

Let's see if I understand what you're trying to accomplish.
You've created three folders. You want to restrict who has
access to these folders. Is that correct? If so, you're going
about this backwards. Try the following and see if it
accomplishes your goal.

Right click on Folder1 and select Properties from the drop down
menu.
Click on the Security tab.
On the Security tab, click on the Advanced button.
On the "Advanced Security Settings" page, remove the check mark
next to "Inherit from parent the permission entries that apply
to child objects. Include these with entries explicitly defined
here."
In the Security box that pops up, click on the Copy button.
Click OK on the Advanced Security settings window.
Back on the Folder1 Properties page, highlight each entry and
hit the Remove button.
Next, click on the Add button.
In the "Select Users or Groups" window, click on the Advanced
button.
In the new window which pops up, click on the "Find Now"
button.
From the list that's displayed, click on the abc account.
Hold down the Ctrl key and click on the Administrators group.
Click OK to close this box.
You should now see the abc account and the Administrators group
listed in the box within "Select Users and Groups".
If so, click OK.
Back in the Folder1 Properties page, click on the abc account
to highlight it.
In the Permissions box, put a check mark in the box next to
Full Control.
Do the same for the Administrators group.
Click OK.

Do the same thing for Folder2 except add the xyz account and
Administrators group.
For Folder3, make sure that only the Administrators group is
listed.

The results of these actions will be that only you and your
daughter will be able to access Folder1, only you and your son
will be able to access Folder2 and only you will be able to
access Folder3.

Note: This will only work if your son and daughter have
accounts that are not members of the Administrators group.

The main reason to create a new group would be if there were
multiple users that needed access to the same resource. For
example, let's say you had 5 user accounts, User1, User2,
User3, User4 and User5. Let's also say that there are several
folders on your D drive that you only want to allow User1,
User2 and User3 to access. Rather than add each individual user
account to the folder permissions it's easier to create a new
group, such as Group1, make User1, User2 and User3 members of
that group and give only that group access permission. Later
on if you decide that User3 no longer needs access but User 4
does, you simply remove User4 from Group1 and add User4.

Keep in mind that you want to add both abc and xyz to the
built-in Users group.

Nepatsfan
!