I know that deleting a userid and creating a new user with the same name
will have really nasty results with ownership of objects, etc., but what
about simply changing the group membership?

I'd like to change a member of the "Administrator" group to "Power User"
or simply "User" for a while to see what (if anything) stops working,
but only if I know that I can always change it back if things get
strange.

--
Bert Hyman St. Paul, MN (E-Mail Removed)

Bert Hyman wrote:
> I know that deleting a userid and creating a new user with the same name
> will have really nasty results with ownership of objects, etc., but what
> about simply changing the group membership?
>
> I'd like to change a member of the "Administrator" group to "Power User"
> or simply "User" for a while to see what (if anything) stops working,
> but only if I know that I can always change it back if things get
> strange.

It won't hurt anything other than user rights conferred by group membership.

John

"Bert Hyman" <(E-Mail Removed)> wrote in message
news:Xns9DEE81D7AF16AVeebleFetzer@216.250.188.141...
>I know that deleting a userid and creating a new user with the same name
> will have really nasty results with ownership of objects, etc., but what
> about simply changing the group membership?
>
> I'd like to change a member of the "Administrator" group to "Power User"
> or simply "User" for a while to see what (if anything) stops working,
> but only if I know that I can always change it back if things get
> strange.
>
> --
> Bert Hyman St. Paul, MN (E-Mail Removed)

You shouldn't have any problem changing it, but remember you'll have to
login as an admin to promote it back to an administrator.
--
SC Tom
-There's no such thing as TMI when asking for tech support.

On 09/09/2010 1:45 PM, Bert Hyman wrote:
> I know that deleting a userid and creating a new user with the same name
> will have really nasty results with ownership of objects, etc., but what
> about simply changing the group membership?
>
> I'd like to change a member of the "Administrator" group to "Power User"
> or simply "User" for a while to see what (if anything) stops working,
> but only if I know that I can always change it back if things get
> strange.
>

I've seen sometimes that certain programs do not start when a user is
running in non-administrator mode. Usually it's things in their startup
that give these kinds of problems.

Yousuf Khan

Bert Hyman wrote:
> In news:(E-Mail Removed) John John - MVP
> <(E-Mail Removed)> wrote:
>
>> Bert Hyman wrote:
>>> I'd like to change a member of the "Administrator" group to "Power
>>> User" or simply "User" for a while to see what (if anything) stops
>>> working, but only if I know that I can always change it back if
>>> things get strange.
>> It won't hurt anything other than user rights conferred by group
>> membership.
>
> I changed my own group membership to "Power User."
>
> The first thing I noticed was that during the login process, some
> malformed, incompletely drawn window popped up and stayed stuck in the
> middle of the screen. There wasn't enough content for me to indentify
> it.
>
> In Task Manager, the only running application was "Visual C++ runtime
> library" (quoting from memory). Nothing showed up in the process list
> that caught my attention. I could drag the window around, and after
> clicking in the spot where the "X" to close button should be, it went
> away.
>
> Then, I saw that the "Quick Launch" section of the toolbar was empty,
> although the blank space appeared to be the same size as it had been
> when populated. Attempts to put things into that space got me an error
> to the effect that I couldn't create shortcuts there and would I like to
> put it on the desktop instead.
>
> That was enough for me to change my group membership back to
> Administrators until I've done some more research.

These things were setup while the user had administrative privileges,
when you demote the account some of these things no longer work due to
insufficient rights.

John

On 9/11/2010 11:59 AM, Bert Hyman wrote:
> In news:(E-Mail Removed) John John - MVP
> <(E-Mail Removed)> wrote:
>
>> Bert Hyman wrote:
>>
>>> ...
>>> Then, I saw that the "Quick Launch" section of the toolbar was empty,
>>> although the blank space appeared to be the same size as it had been
>>> when populated. Attempts to put things into that space got me an
>>> error to the effect that I couldn't create shortcuts there and would
>>> I like to put it on the desktop instead.
>>>
>>> That was enough for me to change my group membership back to
>>> Administrators until I've done some more research.
>>
>> These things were setup while the user had administrative privileges,
>> when you demote the account some of these things no longer work due to
>> insufficient rights.
>
> Does that mean that a new set of privileges are applied to an individual
> user whenever the group membership is applied?

A new set? No, not new, the user will retain his Creator/Owner rights
or other rights that were explicitly granted to him but he will lose
rights conferred by group membership, for example Administrators have
Full Control on the Windows folder, Power Users don't.


> But on reflection, that wouldn't cover the problem with the Quick
> Launch bar, since I'd hope that a "Power User" would have rights to
> modify his own.
>
> So, are there then permssions on each object that a user creates that
> are somehow more restrictive than the rights that come with group
> membership, so that even though a "Power User" can create and use the
> Quick Launch bar in general, he can't use or modify this SPECIFIC Quick
> Launch bar?
>
> What object and permissions control the ability of a "Power User" to
> modify a Quick Launch bar created for that same user when he was in the
> "Administrators" group?

He should have full control on this (Quick Launch) as it is kept in his
profile folder


> If the entire system is filled with little permission-related landmines
> like this, I think I'll wait to make more reasonable group assignments
> until I build my next system :-)

Glitches are common when users are demoted. You can try creating a new
account and make it a member of the Power Users group then try copying
the old profile over to the new account and see how things go. In any
case, as the old saying goes, Power Users are administrator who haven't
yet made themselves administrators...

John