Group Policy - Super user

[GringoMcC]

Hello,

We've just started using 2003 server and I would like to create a new GPO which is a kind of 'Super User'. Basically, part-way between 'Power User' and 'Administrator'. This group would allow users to add/remove local printers, install PDA software (ActiveSync) and USB memory.

I know how to allow/deny access to USB sticks through regedit and file permissions, but the rest is a total mystery!! I've looked at Group Policy Editor on the local machine (Win2k Pro) and there does not appear to be the appropriate settings available for me to modify these permissions.

Any help would be greatly appreciated!

Regards,

Gringo.

 

[tfg13]

This might interest you:

http://www.microsoft.com/downloads/...45-8aa6-4775-9208-c681a7043292&displaylang=en

Great group policy settings. Also gives you an idea of which ones you'll want to use.

 

[ncotton]

What do you NOT want them to be able to do? Becasue you are talking about High Level users, I would have thought Group Policy wouldn't really be the best thing in most cases, create a new group, copy of Administrator, and then modify any system restrictions.

Post what you want to restrict these "Power Users" to, in comparison to just giving them a Admin account. Remember, the Administrators group (default) is only getting the VERY top privs for Server/DCs as the Administrators group is by default, a member of the Domain Admins group. Creating a distracted version of the Administrators group, will lessen the privs very slightly. Not much difference though.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[TekJunkie01]

Quickly, there is a HUGE difference between a GPO and a GROUP or a USER. You have used these terms interchangeably, and they aren't really interchangeable. You would create your group, delegate responsibilities, add users and finally, group them in an OU with an apporpriate GPO linked to it.

A+, N+, MCSA:Messaging, MCSE