User Template -- Domain Administrator..???

[blakey2]

Hi All,

I'm not really a SBS person, having had limited exposure to the product, however I now look after a business running SBS-2003.

I just created a new user, using the 'User Template'. (ie. NOT Power User or Administrator Templates).

It appears that this template is a member of the domain admin's group.

Is this standard setup/practice or has the previous admin modified the template?

NB: Apologies if this question has been asked previously - the search functionality seems not to work for the SBS forum??

Cheers.

 

[58sniper]

That's not normal. Something just ain't right.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[blakey2]

Hi 58Sniper,

Thanks for the prompt reply.

I just opened the 'User Template' Template.

It has a white cross in a red dot - which would normally indicate a disabled user account etc... (?!?)

If I look at the properties it is listed as being a 'Member Of':

[] Administrator Templates
[] Domain Users
[] Power User Templates
[] Remote Web Workplace Users

Like I mentioned, i'm not that SBS savvy, but i would have expected a 'User Template' to be a member of the 'Domain Users Group/Template' nothing more.

I assumed there was (at least domain admin) status permissions on the user accounts as I could do anything on the desktop which i chose to do - alter tcp/ip settings, remove icons from start menu etc (basic stuff yet not permissible from 'Domain User' status only).

Could you please let me know what I should be expecting to see in terms of template (Group??) membership on the 'User Template' properties. (Default settings on a fresh install?)

Additionally if you could explain why the templates have a cross (white cross in red dot) next to them would be appreciated!

Cheers.

 

[Danny28]

You should not be using these templates directly when creating users in an SBS network anyway. SBS tasks should be performed using the integrated wizards. Otherwise you run the risk of breaking apart the "glue" that allows the different components to function correctly.

What you need to launch for any administrative task (creating user, creating a group, adding a machine account, etc.) is a program called "Server Management".
If you can't find the icon, it is located at C:\Program Files\Microsoft Windows Small Business Server\Administration\LaunchConsole.exe.

 

[blakey2]

Hi Danny28,

Yes. I do use the wizards for creating new users etc.

I have inherited this setup from someone else.

The 'user' template appears to give permissions to many more resources than I would expect - in any environment.

There is no wizard that I am aware of to alter the templates, hence I had a look at them through ADUC. I did not change anything myself, only queried whether these would be the default settings?

If you are able to answer that question would be greatly appreciated.

If these are in fact the appropriate template memberships / settings then I suspect that the permissions on the individual workstations have been opened right up.

Thanks.

 

[Danny28]

blakely2,
You are correct. There is no wizard to change the templates, and that's because you shouldn't be changing the templates. Here are the group memberships for SBS user templates on a server that have not been changed to my knowledge:
1.)User Template
Administrator Templates
Domain Users
Power User Templates
Remote Web Workplace Users
2.)Power User Template
Administrator Templates
Domain Power Users
Domain Users
Mobile Users
Remote Web Workplace Users
3.)Mobile Users Template
Administrator Templates
Domain Users
Mobile Users
Power User Template
Remote Web Workplace Users
4.)Administrator Template
Administrator Templates
Domain Admins
Domain Users
Mobile Users
Remote Web Workplace Users
5.)Backup User
Backup Operators
Domain Admins
Domain Users

You definitely do not want to remove any of the groups from the templates, or you will break the wizards that depend on them.

Hope that helps.