PC Review


Reply
Thread Tools Rate Thread

Any harm in changing a user's group membership?

 
 
Bert Hyman
Guest
Posts: n/a
 
      9th Sep 2010
I know that deleting a userid and creating a new user with the same name
will have really nasty results with ownership of objects, etc., but what
about simply changing the group membership?

I'd like to change a member of the "Administrator" group to "Power User"
or simply "User" for a while to see what (if anything) stops working,
but only if I know that I can always change it back if things get
strange.

--
Bert Hyman St. Paul, MN (E-Mail Removed)
 
Reply With Quote
 
 
 
 
John John - MVP
Guest
Posts: n/a
 
      9th Sep 2010
Bert Hyman wrote:
> I know that deleting a userid and creating a new user with the same name
> will have really nasty results with ownership of objects, etc., but what
> about simply changing the group membership?
>
> I'd like to change a member of the "Administrator" group to "Power User"
> or simply "User" for a while to see what (if anything) stops working,
> but only if I know that I can always change it back if things get
> strange.


It won't hurt anything other than user rights conferred by group membership.

John
 
Reply With Quote
 
SC Tom
Guest
Posts: n/a
 
      9th Sep 2010

"Bert Hyman" <(E-Mail Removed)> wrote in message
news:Xns9DEE81D7AF16AVeebleFetzer@216.250.188.141...
>I know that deleting a userid and creating a new user with the same name
> will have really nasty results with ownership of objects, etc., but what
> about simply changing the group membership?
>
> I'd like to change a member of the "Administrator" group to "Power User"
> or simply "User" for a while to see what (if anything) stops working,
> but only if I know that I can always change it back if things get
> strange.
>
> --
> Bert Hyman St. Paul, MN (E-Mail Removed)


You shouldn't have any problem changing it, but remember you'll have to
login as an admin to promote it back to an administrator.
--
SC Tom
-There's no such thing as TMI when asking for tech support.

 
Reply With Quote
 
Yousuf Khan
Guest
Posts: n/a
 
      10th Sep 2010
On 09/09/2010 1:45 PM, Bert Hyman wrote:
> I know that deleting a userid and creating a new user with the same name
> will have really nasty results with ownership of objects, etc., but what
> about simply changing the group membership?
>
> I'd like to change a member of the "Administrator" group to "Power User"
> or simply "User" for a while to see what (if anything) stops working,
> but only if I know that I can always change it back if things get
> strange.
>


I've seen sometimes that certain programs do not start when a user is
running in non-administrator mode. Usually it's things in their startup
that give these kinds of problems.

Yousuf Khan
 
Reply With Quote
 
John John - MVP
Guest
Posts: n/a
 
      10th Sep 2010
Bert Hyman wrote:
> In news:(E-Mail Removed) John John - MVP
> <(E-Mail Removed)> wrote:
>
>> Bert Hyman wrote:
>>> I'd like to change a member of the "Administrator" group to "Power
>>> User" or simply "User" for a while to see what (if anything) stops
>>> working, but only if I know that I can always change it back if
>>> things get strange.

>> It won't hurt anything other than user rights conferred by group
>> membership.

>
> I changed my own group membership to "Power User."
>
> The first thing I noticed was that during the login process, some
> malformed, incompletely drawn window popped up and stayed stuck in the
> middle of the screen. There wasn't enough content for me to indentify
> it.
>
> In Task Manager, the only running application was "Visual C++ runtime
> library" (quoting from memory). Nothing showed up in the process list
> that caught my attention. I could drag the window around, and after
> clicking in the spot where the "X" to close button should be, it went
> away.
>
> Then, I saw that the "Quick Launch" section of the toolbar was empty,
> although the blank space appeared to be the same size as it had been
> when populated. Attempts to put things into that space got me an error
> to the effect that I couldn't create shortcuts there and would I like to
> put it on the desktop instead.
>
> That was enough for me to change my group membership back to
> Administrators until I've done some more research.


These things were setup while the user had administrative privileges,
when you demote the account some of these things no longer work due to
insufficient rights.

John
 
Reply With Quote
 
John John - MVP
Guest
Posts: n/a
 
      12th Sep 2010
On 9/11/2010 11:59 AM, Bert Hyman wrote:
> In news:(E-Mail Removed) John John - MVP
> <(E-Mail Removed)> wrote:
>
>> Bert Hyman wrote:
>>
>>> ...
>>> Then, I saw that the "Quick Launch" section of the toolbar was empty,
>>> although the blank space appeared to be the same size as it had been
>>> when populated. Attempts to put things into that space got me an
>>> error to the effect that I couldn't create shortcuts there and would
>>> I like to put it on the desktop instead.
>>>
>>> That was enough for me to change my group membership back to
>>> Administrators until I've done some more research.

>>
>> These things were setup while the user had administrative privileges,
>> when you demote the account some of these things no longer work due to
>> insufficient rights.

>
> Does that mean that a new set of privileges are applied to an individual
> user whenever the group membership is applied?


A new set? No, not new, the user will retain his Creator/Owner rights
or other rights that were explicitly granted to him but he will lose
rights conferred by group membership, for example Administrators have
Full Control on the Windows folder, Power Users don't.


> But on reflection, that wouldn't cover the problem with the Quick
> Launch bar, since I'd hope that a "Power User" would have rights to
> modify his own.
>
> So, are there then permssions on each object that a user creates that
> are somehow more restrictive than the rights that come with group
> membership, so that even though a "Power User" can create and use the
> Quick Launch bar in general, he can't use or modify this SPECIFIC Quick
> Launch bar?
>
> What object and permissions control the ability of a "Power User" to
> modify a Quick Launch bar created for that same user when he was in the
> "Administrators" group?


He should have full control on this (Quick Launch) as it is kept in his
profile folder


> If the entire system is filled with little permission-related landmines
> like this, I think I'll wait to make more reasonable group assignments
> until I build my next system :-)


Glitches are common when users are demoted. You can try creating a new
account and make it a member of the Power Users group then try copying
the old profile over to the new account and see how things go. In any
case, as the old saying goes, Power Users are administrator who haven't
yet made themselves administrators...

John
 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Changing Group Membership Changes Profile Settings Christopher Isherwood Windows XP Configuration 1 31st Jan 2008 05:25 PM
Changing Local Group Membership =?Utf-8?B?Sm9zaHVhIEJyaWdodA==?= Microsoft Windows 2000 Group Policy 1 20th Aug 2005 05:33 AM
Changing local machine group membership with GPO =?Utf-8?B?QnJhZA==?= Microsoft Windows 2000 Group Policy 3 21st Jul 2004 11:31 AM
Remotely changing admin group membership on clients SCavignac Microsoft Windows 2000 Security 1 17th Jan 2004 01:48 AM
Group Policy and User Group Membership? KA Kueh Microsoft Windows 2000 Group Policy 2 13th Sep 2003 02:51 AM


Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 01:50 PM.