Active Directory Permissions

[Subtle]

Hi all,

I want to either create a new group or change the permissions on another in Active Directory that will allow the domain users to have a bit more access to their local computers. Right now people are in the built-in Domain Users group and they cannot even delete shortcuts made by the local administrator or delete existing printers. I'd like for them to be able to do this, but I don't want to make them all local administrators (that would give them too much access to their computer).

Any ideas?

 

[kmkeshav]

You can make the users as "Power Users", but before you do this, read the consequences of adding a user to Power Users group:

http://support.microsoft.com/kb/825069

-Keshav / IT Consultant

 

[porkchopexpress]

Power user still shouldn't be able to delete shortcuts created by admins, also Power users with a bit of know how can elevate themselves to admins.
Power users was created for compatibility and MS are trying to phase the idea out, we used it for a while and discovered that almost anything can be installed especially toolbars, spyware and any other carp that users decide they want to install.

You know what Jack Burton always says at a time like this...

 

[58sniper]

Everyone above is right. There are ways to deploy printers automagically, as well as other tasks that may need to be done. Anything above Domain Users is asking for trouble.

Pat Richard, MCSE MCSA:Messaging CNA
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt