administrator rights

[wnterhawk]

OK I'm sorry if this is a stupid question. But in windows 2000 and NT environment. I just want to be clear on the rights using the names administrator and network administrator and domain administrator.
If a person is given rights as administrator... they have administrative rights on that desktop but not the network. Is there anyway that the wording "administrator" when giving a person rights would allow them more than just desktop rights. Here is what I'm working on.
If i go into user manager and I'm looking at the users on the domain. I can see what kind of rights they have. If they are power users etc. If I give a user rights as administrator, do they get rights on the domain or network at all, or do they only get rights on their desktop.
When we set up profiles on the desktop so they log in locally ...then I know I am only giving administrator control on that desktop. But if I give it to them thru the user manager on the PDC, does that still only give it to them on their own desktop. Am I right to think that to give them a wider network control I would have to give them network administrator rights or domain rights?
or am I just totally confused.
Thanks

 

[mrmoneymatters]

If you are trying to give users admin rights on local computers you need to do that on the local machines under computer management. Inside there you will find users and groups, go to groups, administrators, and add a domain user to that group.
There are multiple groups called administrators, at the local level and domain level. You shouldn't ever put a user into the administrators group at the domain level.


Network Admin
A+, Network+, MCSA 2000, MCSE 2000

 

[wnterhawk]

so if we have users that log onto the domain, for access to their computer. They don't have a local profile on the computer. How do I give them administrator rights to their computer only? Since unfortunately one of the applications we have requires the user to have administrator rights for it to update ..automatically. Do I have to set each user up with a profile on their computer? Or is there a way to give them admin rights and still log in thru the domain.

 

[mrmoneymatters]

Actually, each time a user logs on to a workstation with a domain account, the os creates a local profile.

Now, If I were you I would create a security group for all the users that need full access to their on computers. Then add all of those users to that group. Last, use your computer management snapin and connnect to each computer,(when computer management is open right click on local and choose connect to another computer), then go to local users and groups.Under groups you will see administrators, right click and go to properties, then you will see an add button, click on the add button. You now need to navigate to the domain users, select the security group I told you to add or select the user you are adding.

All this does is give the user or group admin rights to the machine that you are doing this on. It does not affect any other machine.

Network Admin
A+, Network+, MCSA 2000, MCSE 2000