Guest Kevin Posted March 15, 2008 Posted March 15, 2008 I have just installed Windows 2003 as a domain server at home and have used Active Directory. I want the kids to be Administrators on their computer, so they can install MSN etc, but I want to make sure they are not Domain Administrators so they cannot change the server setting. Is this possible? Am brand new to servers and their setup and it looks a lot to learn! - so any guidance will be most helpful. Thanks in advance Kevin
Guest Meinolf Weber Posted March 15, 2008 Posted March 15, 2008 Re: Win 2003 User Admin Rights Hello Kevin, Use Restricted groups: http://www.frickelsoft.net/blog/?p=13 Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights. ** Please do NOT email, only reply to Newsgroups ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm > I have just installed Windows 2003 as a domain server at home and have > used > Active Directory. > I want the kids to be Administrators on their computer, so they can > install > MSN etc, but I want to make sure they are not Domain Administrators so > they > cannot change the server setting. > Is this possible? > Am brand new to servers and their setup and it looks a lot to learn! - > so > any guidance will be most helpful. > Thanks in advance > Kevin
Guest Paul Weterings Posted March 15, 2008 Posted March 15, 2008 Re: Win 2003 User Admin Rights I'm interpreting Kevin's question differently: I'm understanding from the message that the kids have their own computers. I'm assuming these computers are domain members, otherwise there would be little reason for you to set up a domain server (b.t.w.; the correct name is Domain Controller). That makes the answer to the question far more basic than using restricted groups: If the above is assumed correctly: simply make Domain user accounts in AD for your kids, and put these accounts in the local administrator group of the computers. (so on their own computers, check the management console) This way your kids are admin on their own system, but do not have any rights anywhere else. You might actually want to considermaking your kids Power User instead of local Admin, look it up. cheers, Paul Meinolf Weber wrote: > Hello Kevin, > > Use Restricted groups: > http://www.frickelsoft.net/blog/?p=13 > > Best regards > > Meinolf Weber > Disclaimer: This posting is provided "AS IS" with no warranties, and > confers no rights. > ** Please do NOT email, only reply to Newsgroups > ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm > >> I have just installed Windows 2003 as a domain server at home and have >> used >> Active Directory. >> I want the kids to be Administrators on their computer, so they can >> install >> MSN etc, but I want to make sure they are not Domain Administrators so >> they >> cannot change the server setting. >> Is this possible? >> Am brand new to servers and their setup and it looks a lot to learn! - >> so >> any guidance will be most helpful. >> Thanks in advance >> Kevin > >
Guest Kevin Posted March 15, 2008 Posted March 15, 2008 Re: Win 2003 User Admin Rights Thanks - will try these out. Paul has exactly described the situation - shows how green I am. Kevin "Paul Weterings" <Paul-nospam-@syncpuls-dot-com> wrote in message news:47dc4b44$0$6133$e4fe514c@dreader27.news.xs4all.nl... > I'm interpreting Kevin's question differently: > > I'm understanding from the message that the kids have their own computers. > I'm assuming these computers are domain members, otherwise there would be > little reason for you to set up a domain server (b.t.w.; the correct name > is Domain Controller). > > That makes the answer to the question far more basic than using restricted > groups: > > If the above is assumed correctly: simply make Domain user accounts in AD > for your kids, and put these accounts in the local administrator group of > the computers. (so on their own computers, check the management console) > This way your kids are admin on their own system, but do not have any > rights anywhere else. > > You might actually want to considermaking your kids Power User instead of > local Admin, look it up. > > cheers, > > Paul > > Meinolf Weber wrote: >> Hello Kevin, >> >> Use Restricted groups: >> http://www.frickelsoft.net/blog/?p=13 >> >> Best regards >> >> Meinolf Weber >> Disclaimer: This posting is provided "AS IS" with no warranties, and >> confers no rights. >> ** Please do NOT email, only reply to Newsgroups >> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm >> >>> I have just installed Windows 2003 as a domain server at home and have >>> used >>> Active Directory. >>> I want the kids to be Administrators on their computer, so they can >>> install >>> MSN etc, but I want to make sure they are not Domain Administrators so >>> they >>> cannot change the server setting. >>> Is this possible? >>> Am brand new to servers and their setup and it looks a lot to learn! - >>> so >>> any guidance will be most helpful. >>> Thanks in advance >>> Kevin >>
Guest lforbes Posted March 16, 2008 Posted March 16, 2008 Re: Win 2003 User Admin Rights I also suggest not giving anyone admin access unless absolutely necessary. Admin access means the ability to destroy the local xp machine. I have 2500 users and only 3 who are local admins on their own machines. I have found that people with admin access inadvertently destroy the machine whether they intend to or not. I don't have time to spend rebuilding every week. MSN is built into the OS anyway. Cheers, Lara "Kevin" wrote: > Thanks - will try these out. > Paul has exactly described the situation - shows how green I am. > > Kevin > > "Paul Weterings" <Paul-nospam-@syncpuls-dot-com> wrote in message > news:47dc4b44$0$6133$e4fe514c@dreader27.news.xs4all.nl... > > I'm interpreting Kevin's question differently: > > > > I'm understanding from the message that the kids have their own computers. > > I'm assuming these computers are domain members, otherwise there would be > > little reason for you to set up a domain server (b.t.w.; the correct name > > is Domain Controller). > > > > That makes the answer to the question far more basic than using restricted > > groups: > > > > If the above is assumed correctly: simply make Domain user accounts in AD > > for your kids, and put these accounts in the local administrator group of > > the computers. (so on their own computers, check the management console) > > This way your kids are admin on their own system, but do not have any > > rights anywhere else. > > > > You might actually want to considermaking your kids Power User instead of > > local Admin, look it up. > > > > cheers, > > > > Paul > > > > Meinolf Weber wrote: > >> Hello Kevin, > >> > >> Use Restricted groups: > >> http://www.frickelsoft.net/blog/?p=13 > >> > >> Best regards > >> > >> Meinolf Weber > >> Disclaimer: This posting is provided "AS IS" with no warranties, and > >> confers no rights. > >> ** Please do NOT email, only reply to Newsgroups > >> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm > >> > >>> I have just installed Windows 2003 as a domain server at home and have > >>> used > >>> Active Directory. > >>> I want the kids to be Administrators on their computer, so they can > >>> install > >>> MSN etc, but I want to make sure they are not Domain Administrators so > >>> they > >>> cannot change the server setting. > >>> Is this possible? > >>> Am brand new to servers and their setup and it looks a lot to learn! - > >>> so > >>> any guidance will be most helpful. > >>> Thanks in advance > >>> Kevin > >> > >
Guest Meinolf Weber Posted March 16, 2008 Posted March 16, 2008 Re: Win 2003 User Admin Rights Hello Paul, Sorry but even if he starts with Domain controllers, i was asuming that he has created domain user accounts and restricted groups is the easiest way to make accounts local admins or even local power users like you mention WITHOUT going to any machine and add them by hand to the local administrators. Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights. ** Please do NOT email, only reply to Newsgroups ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm > I'm interpreting Kevin's question differently: > > I'm understanding from the message that the kids have their own > computers. I'm assuming these computers are domain members, otherwise > there would be little reason for you to set up a domain server > (b.t.w.; the correct name is Domain Controller). > > That makes the answer to the question far more basic than using > restricted groups: > > If the above is assumed correctly: simply make Domain user accounts in > AD for your kids, and put these accounts in the local administrator > group of the computers. (so on their own computers, check the > management console) This way your kids are admin on their own system, > but do not have any rights anywhere else. > > You might actually want to considermaking your kids Power User instead > of local Admin, look it up. > > cheers, > > Paul > > Meinolf Weber wrote: > >> Hello Kevin, >> >> Use Restricted groups: >> http://www.frickelsoft.net/blog/?p=13 >> Best regards >> >> Meinolf Weber >> Disclaimer: This posting is provided "AS IS" with no warranties, and >> confers no rights. >> ** Please do NOT email, only reply to Newsgroups >> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm >>> I have just installed Windows 2003 as a domain server at home and >>> have >>> used >>> Active Directory. >>> I want the kids to be Administrators on their computer, so they can >>> install >>> MSN etc, but I want to make sure they are not Domain Administrators >>> so >>> they >>> cannot change the server setting. >>> Is this possible? >>> Am brand new to servers and their setup and it looks a lot to learn! >>> - >>> so >>> any guidance will be most helpful. >>> Thanks in advance >>> Kevin
Recommended Posts