Active Directory question...

M

Mizugori

[H]ard|Gawd
Joined
Mar 25, 2004
Messages
1,240
I created a new user account, and when I log into it it works fine but it has many limitations. I feel like every time I try to do anything remotely 'advanced' I get a popup saying I don't have permissions. Can't uninstall a lot of things, can't go into the tcp/ip settings, etc etc

Where are these permissions coming from? I have access to the administrator account, I just don't know how to make one user more privileged than another...

Thanks
 
You probably need to elevate the rights of that particular user on the local machine. If you created the user in AD, then, by default, that user will be given basic user rights on all domain systems.
 
Adding the "domain users" group to the "local <admin> group"....or whatever local group you desire.
 
DeaconFrost said:
You probably need to elevate the rights of that particular user on the local machine. If you created the user in AD, then, by default, that user will be given basic user rights on all domain systems.
Click to expand...

I am strictly speaking AD accounts, always logging onto the domain never locally onto the machine. So if I want to give one specific user (say jsmith) better rights, how do I do it in AD?
 
Mizugori said:
I am strictly speaking AD accounts, always logging onto the domain never locally onto the machine. So if I want to give one specific user (say jsmith) better rights, how do I do it in AD?
Click to expand...
So am I. I grant my AD user accounts local admin access to their own computers on their local machines. All of my users always log in using their domain accounts. If you are messing with AD, you should know how to grant rights on a local system....which is done through the MMC.

You can either grant that local account admin rights on your local computer, or you can follow YeOldeStonecat's advice, which would let all AD users have local admin rights to whatever box that they log in to.
 
I would never let users have any type of administrator account privies.

Check e-mail, surf some sites for work related purposes, work stuff... that's it.
 
ben chi(f4) said:
I would never let users have any type of administrator account privies.

Check e-mail, surf some sites for work related purposes, work stuff... that's it.
Click to expand...

Personally I think it's suicide as well but it didn't really sound like this was for a production setup. At least I hope not.
 
From a a sys admin standpoint, I can give many reasons for fgranting users admin rights on their own boxes. Mainly, I don't feel like having to visit each desk to install a printer, install software, etc. Most of my users are remote as well, and if, for example, they buy a new printer, I don't want to have to give out the local admin account info just so they can install the printer.

Maybe some groups of emploees elsewhere would cause issues with this, but not in my company, so it may differ from place to place.
 
Can someone please explain how to manually make someone a local admin? I am so freaking confused at this point. I actually don't want to do it via group policy it's just happening to one account. I'm not making everyone local admins. I am now logged onto the computer ON THE DOMAIN as the administrator. How can I make one user (say its named jsmith on the domain DOMAIN) into a local admin???

so to be totally clear, i logged onto the computer by typing 'administrator' and i selected DOMAIN in the dropdown box. Thus I did not log onto the workstation locally. I want to make it so that when the user jsmith logs onto the computer on the domain, he can do any freaking thing he pleases.

thanks
 
Mizugori said:
I want to make it so that when the user jsmith logs onto the computer on the domain, he can do any freaking thing he pleases.
thanks
Click to expand...
I sent you a PM reply....you're definitely missing what I'm trying to say.
 
On the local system:

1. Right Click My Computer
2. Choose Manage
3. Expand Local Users and Groups
4. Click on Groups
5. Double click Administrators
6. Click Add...
7. Make sure the "From this Location:" says the name of your domain
8. Under Enter the object names to select (examples):, put in the username
9. Click Check Names
10. Click OK
11. Click OK again
12. Logout
13. Have the user login
 
Zlash said:
/forehead --> desk...
Click to expand...

Man this provided me with enough laughing out loud to make my co-workers look at me wierd.

But anyway, you're logged in as local administrator:
  • Right Click the My Computer Icon
  • Select Manage
  • Click the + next to Local Users and Groups
  • Click Groups
  • Double Click Administrators Group
  • Click Add
  • Make sure that the From Location is your domain.
  • type user's ID in the blank area, i.e. jsmith
  • Click Check Names - if it underlines the name you're good.
  • Ok
  • Ok
  • Logout and login as user. If you can right click on My Computer and select properties and you get more than 5 tabs in the system properties window you're good.
  • Profit
 
Man this provided me with enough laughing out loud to make my co-workers look at me wierd.
Click to expand...

Seriously...how hard is it lol. I sure hope it isn't for a job this person has!
 
ok i know you guys all think i am retarded but allow me to explain a bit. these steps are basically what i did, only when i go to from this location i cannot select the domain... it only shows the computers name and i can't change it. so i got confused and thought i was doing it wrong, started googling how to make a local admin, and then posted here. but apparently i am doing it right... so any ideas why i cant select the domain there?


ND40oz said:
On the local system:

1. Right Click My Computer
2. Choose Manage
3. Expand Local Users and Groups
4. Click on Groups
5. Double click Administrators
6. Click Add...
7. Make sure the "From this Location:" says the name of your domain
8. Under Enter the object names to select (examples):, put in the username
9. Click Check Names
10. Click OK
11. Click OK again
12. Logout
13. Have the user login
Click to expand...
 
Under Locations, all you see is the name of the local computer, or do you see Entire Directory too?
 
Is the computer joined to the domain? For what it's worth, you don't "create" a local administrator account....it is already there.
 
If all you can see if the computer's name, remove and re-add it to the domain.
 
If the active directory isn't show up as available to pull the domain user accounts from...I suspect your DNS is also not setup correctly. Workstation must must MUST, be using your DCs IP address as its DNS server. Not your router. Not your ISPs. Not OpenDNS...not anything else....just your DCs IP.
 
ben chi(f4) said:
I would never let users have any type of administrator account privies.

Check e-mail, surf some sites for work related purposes, work stuff... that's it.
Click to expand...

Generally i don't either, however every now and then you run into that one pain in the arse app that requires admin rights to run, then your screwed
 
YeOldeStonecat said:
If the active directory isn't show up as available to pull the domain user accounts from...I suspect your DNS is also not setup correctly. Workstation must must MUST, be using your DCs IP address as its DNS server. Not your router. Not your ISPs. Not OpenDNS...not anything else....just your DCs IP.
Click to expand...

omg THANK YOU THANK YOU that was the problem
 
I would just love to hear the background of this story, of where you work and what you do, having access to the domain admin account...
 
YeOldeStonecat said:
If the active directory isn't show up as available to pull the domain user accounts from...I suspect your DNS is also not setup correctly. Workstation must must MUST, be using your DCs IP address as its DNS server. Not your router. Not your ISPs. Not OpenDNS...not anything else....just your DCs IP.
Click to expand...
Warning: If you don't have a solid grasp of AD and DNS, do not read the following. It won't do you any good.

Now, the DC doesn't necessarily have to be the DNS server for the WS. At my current location, we had BIND handling the DNS duties. We didn't feel like causing a major upheaval, so we just setup the AD zone as a slave on the BIND boxes. Works perfectly fine.
 
REDYOUCH said:
I would just love to hear the background of this story, of where you work and what you do, having access to the domain admin account...
Click to expand...

your sarcasm is not appreciated, and it does not contribute to the thread.
 
XOR != OR said:
Warning: If you don't have a solid grasp of AD and DNS, do not read the following. It won't do you any good.

Now, the DC doesn't necessarily have to be the DNS server for the WS. At my current location, we had BIND handling the DNS duties. We didn't feel like causing a major upheaval, so we just setup the AD zone as a slave on the BIND boxes. Works perfectly fine.
Click to expand...

Was trying to keep this on the conventional Windows network level, as in many cases I'll see situations where active directory is setup, yet the DHCP is still running default settings on the router...so clients get the routers LAN IP, or the ISPs DNS server, for their DNS. They will not be having a good time trying to join the workstations to the directory...not to mention log in. It breaks a lot of stuff.
 
YeOldeStonecat said:
Was trying to keep this on the conventional Windows network level, as in many cases I'll see situations where active directory is setup, yet the DHCP is still running default settings on the router...so clients get the routers LAN IP, or the ISPs DNS server, for their DNS. They will not be having a good time trying to join the workstations to the directory...not to mention log in. It breaks a lot of stuff.
Click to expand...
Sure, just making sure the information is there for reference. Never know who's reading this and why.
 
ben chi(f4) said:
I would never let users have any type of administrator account privies.

Check e-mail, surf some sites for work related purposes, work stuff... that's it.
Click to expand...

Like otherwise stated, I can think of some very darn good reasons for it.
Installing printers, installing little pieces of software I don't care about, etc.

If you get too restrictive: your users WILL find a way around it.
Look at schools. They have very good reasons for it, and students are ALWAYS finding ways around it.

Give the users some freedom, and an IT policy to explain what's expected, and it shouldn't be an issue.

That, and if I need to assist a user I'd rather do it in 10 seconds to do it on their account versus 2 minutes to have them exit their apps, log off, log on as an Administrator, fix the issue, log off, log back on as the user, then start all their apps back up.
 
TechieSooner said:
Installing printers, installing little pieces of software I don't care about, etc.
Click to expand...
The devil is in the details.

What happens if a user installs an application which the EULA restricts to a single system at a time? Then, say you get audited by the BSA. You are left holding the bag, not the user. And that is a non-trivial amount of change to have to pony up.

I lock my users down to limited; they aren't allowed to do anything without the IT dept's say so. That's how it should be. Users need to get used to the idea that company workstations aren't theirs to do with as they please.
 
XOR != OR said:
Users need to get used to the idea that company workstations aren't theirs to do with as they please.
Click to expand...
And that starts with policies laid out on their day of hire. I don't lock down my employees workstations, because I have enough work to do as the lone IT guy. However, I've created an atmosphere where they know to ask me first.
 
DeaconFrost said:
And that starts with policies laid out on their day of hire. I don't lock down my employees workstations, because I have enough work to do as the lone IT guy. However, I've created an atmosphere where they know to ask me first.
Click to expand...
String a few up? Accidently left exposed copper to a 120 line on the user's chair?

Not that I recommend any of these techniques. Because that would be wrong.
 
TechieSooner said:
That's something policies protect you from.
Click to expand...
Yep, it is clearly laid out in our employee manual what the policies and guidelines are in terms of company owned computer equipment. Each employee signs a sheet from their manual once a year, acknowledging that they have read and agree to those policies.
 
You must log in or register to reply here.
Back
Top