Setting up a domain user to have local admin rights

Bo...@leonhardresearch.dk

unread,

Mar 9, 2001, 4:26:34 AM3/9/01

to

Hi

A novice problem : We've created a domain using a Win2K server and added a
few users to it. The users are members of the users group. Now as my users
are mostly SW developers they frequently want to make changes to their PC.
But they don't have local admin rights as they're only members of the
users group. I could promote them to PowerUsers, but that would also give
them some server rights, and I surely don't want that ?
Currently they need to log on locally to do their changes, but this is a
pain in the ... for them, as they don't have access to the resources on
the domain.

Any help is welcome

-Bo

KlausL

unread,

Mar 9, 2001, 6:49:15 AM3/9/01

to

<Bo...@leonhardresearch.dk> wrote in message
news:98a7ka$clk$1...@news.net.uni-c.dk...

Bo,

AFAIK you could create local accounts for them and give them
local admin privileges. As long as the local account name/password
is the same as the domain account/password they should be right.
They will have to remember to change both passwords at the same
time.

Klaus

Martin Köhler

unread,

Mar 9, 2001, 7:12:15 AM3/9/01

to

Hi Bo,
add them into the administrator group _on their machine_. That is open
Computer Management (or User Manger if in NT4.0) and connect to the users
PC's.
In Local User\group add the Domain Account of your user to the Local Admin
or Power User group.
Thats it.
BTW: The Domain Admin get Admin rights on the PC's since the Domain global
group Domain Admins is automatically included into the PC local Admin group.
Same analog for Domain users and local users.
Hope this hepls.
Martin

<Bo...@leonhardresearch.dk> wrote in message
news:98a7ka$clk$1...@news.net.uni-c.dk...

Bruce Chambers

unread,

Mar 9, 2001, 9:44:28 AM3/9/01

to

Greetings --

Simply go to their machines, log with administrative privileges, and
then add the users' domain accounts to the PC local administrators group.

HTH&GL,
Bruce Chambers

Natural laws have no pity. -- RAH

<Bo...@leonhardresearch.dk> wrote in message
news:98a7ka$clk$1...@news.net.uni-c.dk...

Bruce Chambers

unread,

Mar 9, 2001, 9:46:35 AM3/9/01

to

Greetings --

Wouldn't really work the way they want, as Win2K would treat each
account as unique, because they'd have different SIDs. Remember, the user
"name" is only a convenience for us carbon-based life forms.

HTH&GL,
Bruce Chambers

Natural laws have no pity. -- RAH

"KlausL" <NoJunkMail&Kla...@attglobal.net> wrote in message
news:98afvq$1es2$1...@arachne.labyrinth.net.au...

EJP

unread,

Mar 13, 2001, 1:20:43 PM3/13/01

to

In my experience NT matches usernames up across boxes but not with domains. if i have a local account on box1 and make a connection to box2 it matches up the names to the local account on box2 which has a different SID. So its not always the case that
SID must match. But as Bruce said, it doesn't seem to like to cross over from local to domain. When i create a share i generally give administrative rights to both local admin and domain admin so when i'm using a local admin account on box1 i can still
get admin access to box2.

Give em the local admin account and worst case, they must log out and use the other account, which is safer than having admin priviledges all the time anyway. its dangerous to do day to day work at admin level.

Jay

Jeffrey Overman

unread,

Mar 21, 2001, 10:37:31 AM3/21/01

to

On Fri, 9 Mar 2001 07:44:28 -0700, Bruce Chambers
<bcha...@nojunk.micron.net> wrote:
> Greetings --
>
> Simply go to their machines, log with administrative privileges, and
> then add the users' domain accounts to the PC local administrators group.

This can be done remotely using User Manager For Domains (NT4). Go to
'Select Domain' and enter '\\Computername' as domain.

Greetz,

--
Jeffrey Overman [mailto:jeff...@nl.demon.net]