When I joined the Citrix server to Active Directory, suddenly all users have rights to restart or worst, shutdown the server. Before joining AD, there use to be a group called, Power Users. That group is no longer around after joining AD. Now everybody seem to have Power Users rights. How do i remove that access and what ever happened to Power Users group??
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
regular users can now restart/shutdown citrix server
- Thread starter otisteav
- Start date
Hey otisteav,
That exact thing happend to me. We have 30 citrix servers running windows 2000 sp/2 and MF 1.8 w/sp3. Our servers had NT policies applied to it and they worked great!
After our move to AD they stopped working!!!!! Our end-users had the ability to reboot/shutdown/install wallpaper/screensavers and other bad things. The reason why our policies stopped working was because the policies were created with a NT 4 policy editor (poledit). This worked great if u were in a NT 4.0 environment but it doesn't work in a Ad environment. You'll have to create an OU for your citrix servers and then move your citrix servers into that OU. Then you will apply Group Policies via Ad to that OU and that should take care of it.
Hope that helps out.
That exact thing happend to me. We have 30 citrix servers running windows 2000 sp/2 and MF 1.8 w/sp3. Our servers had NT policies applied to it and they worked great!
After our move to AD they stopped working!!!!! Our end-users had the ability to reboot/shutdown/install wallpaper/screensavers and other bad things. The reason why our policies stopped working was because the policies were created with a NT 4 policy editor (poledit). This worked great if u were in a NT 4.0 environment but it doesn't work in a Ad environment. You'll have to create an OU for your citrix servers and then move your citrix servers into that OU. Then you will apply Group Policies via Ad to that OU and that should take care of it.
Hope that helps out.
It's possible to use local Group policies under Win2K if needed. Run gpedit.msc on a 'master' server- then copy the files from %systemroot%\winnt\system32\group policy (hidden folder) to the corresponding folders on your servers- then deny read permission for the folders to admins and bingo off you go.
You can also place the files on a central server and force the others in the farm to read from them. Logon on time is extended though.
Hope this helps.
You can also place the files on a central server and force the others in the farm to read from them. Logon on time is extended though.
Hope this helps.
- Thread starter
- #4
Thanks enigma99 and Strongone for your post, but I had
a feeling that my problem was much more simplistic. And it was afer talking to MS tech support.
Before joining AD, local security policy only had 'administrators' and 'power users' the right to 'shutdown system'. After joing AD, local security policy was still the same, HOWEVER, effective policy settings came into play. So, it turned out that the Domain Controller Policy had Printer Operators with rights to shutdown system. And sure enough, users were a member of Printer Operators.
I removed the Printer Operators from 'shutdown system' and everything to back to normal.
a feeling that my problem was much more simplistic. And it was afer talking to MS tech support.
Before joining AD, local security policy only had 'administrators' and 'power users' the right to 'shutdown system'. After joing AD, local security policy was still the same, HOWEVER, effective policy settings came into play. So, it turned out that the Domain Controller Policy had Printer Operators with rights to shutdown system. And sure enough, users were a member of Printer Operators.
I removed the Printer Operators from 'shutdown system' and everything to back to normal.
- Status
Similar threads
- Locked
- Question
- Locked
- Question