account question

[XIanMacX]

I have a 2000 domain,
heres my question... when you add a workstation to the domain it adds the domain admins group to the local admin group,
what is the purpose of this, after you add it to the domain and then try to log on locally, theres no way for the system to authenticate to the "domain users" group, that is now a member of the "local admins" group

so whats the purpose...
thanks in advance

 

[XIanMacX]

sorry, the last "domain users" should read "domain admin"

 

[GlenJohnson]

When you log onto a domain for the first time, it creates a new account for the user. You need to go into the domain admins group and add the user for the pc into that group, otherwise they can't install software or do updates, etc. You also need to copy the username over to the username/domainname, and set the allow access to the username/domainname. (This is a long way of saying it's changing security settings for the user on the domain.) Glen A. Johnson
Microsoft Certified Professional
gjohn76351@msn.com

"It is never too late to learn what is always necessary to know."
Lucius Annaeus Seneca (4 BC - 65AD) Roman philosopher, statesman.

 

[XIanMacX]

Glen: When you log onto a domain for the first time, it creates a new account for the user

where does it create a new account, obviously the domain account is already created (or else you could not log into the domain) and it also doesn't create a local account on the workstation (in users and computers) i still only show Guest and Administrator...

thanks again....

 

[Jeff1242]

I think the reason may be so that Domain Administrators have access to change stuff on your computer. Without local Admin group access, you can't change anything on the local computer. I think its added to make sure that all Domain admins can do whatever they want with any computers on the domain. You wouldn't have a very powerful Domain Administrator if he couldn't change any local computer settings

 

[GlenJohnson]

There's a couple of things. IF you go to docoments and settings, you'll see username, and username.domainname. If you right click my computer and select properties, you'll see a tab that says user profiles. The first time you log on as a user, then log off and log back on as admin. Copy the username over to the username/domainname there, and a button will show up that you have click that says allow to use. Make sure the drop down button has selected the domain, and browse to find the user. This will give him rights on the domain under his old account. Close that when your done, right click on my computer and select manage. In the administrators group, add domainname/username so they can have control over the pc. Hope this helps. Glen A. Johnson
Microsoft Certified Professional
gjohn76351@msn.com

"It is never too late to learn what is always necessary to know."
Lucius Annaeus Seneca (4 BC - 65AD) Roman philosopher, statesman.