No I made a global user group coul have used a local group but figured what the
heck you never know if I feel like addiung another NT server. Then I added all
the users into it. Then all I have to do is go to the workstation and add that
group into the local admin group. Having admin for the workstations is no biggy
becuase there aren't any shares on the net, but my logins to the server are the
same as to the workstaion so they were already added into the admin group. Even
if I went in and selected them again it didn't work. So I had to do something
completely different that didn't exist on the local machine and that was make a
new group. If I had different login names to the server and to the workstation
your method would have worked. Guesse it's just a "feature" with NT
Bob
Cal Frye wrote:
> I'm not sure I follow. Do you mean you have a separate local or domain group
> for administration of the local workstation? For our staff, I wanted to
> permit them to install software, manage their printers, and such like
> without our intervention (some use little label printers, Palm devices, and
> the like). So if each user is an administrator (along with the Domain
> Admins) of his individual workstation, that's OK. So we added just the
> individual domain user (the account they regularly logged in as) into the
> local Administrators group, they have admin rights for that workstation
> only. Using a group, each staffer would have administrative rights for every
> other workstation, too. We didn't want to do that. Since it's a global
> account in a local group, it has to be done on each workstation, but only
> once. I did err in the beginning by putting the local user
> (\WORKSTATION\Username) in the Administrators group instead of the domain
> account (\DOMAIN\Username). Since they have to login to the domain to get to
> the server shares, the local user account isn't actually used (and doesn't
> exist on many machines, but did on some--hence my confusion). This is a very
> messy topic. Best explication I've seen yet is in Minasi, Anderson, and
> Creegan, Mastering Windows NT Server 4 (Sybex). That one's on the nearest
> shelf over my desk.
>
> --Cal Frye, Western Reserve Academy, Hudson, Ohio
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Robert Everland
> III
> Sent: Friday, November 05, 1999 3:19 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [IMail Forum] Off topic - User Rights
>
> Carl one thing I did notice though is that if the users are the same name as
> the
> domain it still doesn't work. The only way to get it so they have rights on
> the
> computer is to make a group with all the users in it and use the group. The
> users that I wanted access to on the computer were already there but when I
> added a new group I made I was able to be the admin on that computer but
> still
> have the rights on the shares I needed.
>
> Bob Everland
>
> Cal Frye wrote:
>
> > Robert--
> > I don't see this elsewhere on the list (haven't gotten through today's
> inbox
> > yet), so I'll have a go.
> > We're doing this around here with our administrative machines, and I'm
> sorry
> > we didn't do it when we installed 'em. Go to each workstation (ugh!) and
> > login as administrator. Open the User Manager (NOT the user manager for
> > domains). Open the Administrator's group (the local one). Click the Add
> > button, and be sure to select the desired local user FROM THE DOMAIN users
> > list (see the List Names From dropdown box). Took me a while to catch on
> to
> > the fact that the domain user isn't the same as the local user of the same
> > name. Now it works.
> >
> > --Cal Frye, Western Reserve Academy, Hudson, Ohio
> >
> > -----Original Message-----
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED]]On Behalf Of Robert Everland
> > III
> > Sent: Thursday, November 04, 1999 6:33 PM
> > To: [EMAIL PROTECTED]
> > Subject: [IMail Forum] Off topic - User Rights
> >
> > I am running a mix enviroment of NT Server and NT Workstation. When the
> NT
> > workstations log on to the NT server I can't do anything locally to the
> > machine, as
> > in share files, use the user mahcine and get any share that I process
> though
> > loing
> > scripts unless they are a member of Domain Admins which is a global group.
> > Only
> > thing though that is if they are a member of Domain Admin they are able to
> > do
> > everything to the computer and I have no idea why. Where are the rights
> for
> > groups
> > given at? I would like the computers to have admin rights at thier
> computers
> > only
> > and have the rights I give them at the shares seperate. Can I even do this
> > for NT
> > workstation or do I have to log on locally and do it like that? I used to
> > have a
> > domain with all 95 98 and since there are no computer rights they were
> able
> > to do
> > whatever they wanted. Also no policies are enable disabling anything.
> >
> > Bob Everland
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
> >
> > Please visit http://www.ipswitch.com/support/mailing-lists.html
> > to be removed from this list.
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
