How to allow any domain user to logon to a XP Pro PC

[jblaze]

Hello.

Can anyone tell me if and how it is possible to allow any Domain User
(windows server 2003 std) the right to logon on to a Windows XP Pro
Machine. This seems like it shouldn't be too hard but i can't figure
it out.

Right now, anytime I stage a new pc i have to go under Control Panel |
User Accounts | Add User | type in the user name and domain | and
define the users group membership as Administrators in order to allow
them to logon.

Realistically, it is not practical to perform these steps for each
user that will using this PC.

What i have tried.

I have tried going under the PC's Group Policies and changing the :
Local Computer Policy | Windows Settings | Security Settings | Local
Policies | User Rights Assignment | Log On Locally and adding the
'domain users' group but it doesn't alow me to add or remove any item
in this field.

Also....

I went under the doman security policies looking to change a similar
setting but no luck there either.

Thanks for your help.....

~JH

 

[Guest]

Hello.

Can anyone tell me if and how it is possible to allow any Domain User
(windows server 2003 std) the right to logon on to a Windows XP Pro
Machine. This seems like it shouldn't be too hard but i can't figure
it out.

Right now, anytime I stage a new pc i have to go under Control Panel |
User Accounts | Add User | type in the user name and domain | and
define the users group membership as Administrators in order to allow
them to logon.

Realistically, it is not practical to perform these steps for each
user that will using this PC.

What i have tried.

I have tried going under the PC's Group Policies and changing the :
Local Computer Policy | Windows Settings | Security Settings | Local
Policies | User Rights Assignment | Log On Locally and adding the
'domain users' group but it doesn't alow me to add or remove any item
in this field.

Also....

I went under the doman security policies looking to change a similar
setting but no luck there either.

Thanks for your help.....

~JH

Why not putting the windows xp computer into your domain ( so that every
domain user can logon to that computer)

if you dont want the computer into your domain then the solution is:
create an account for every user

 

[Bruce Chambers]

Hello.

Can anyone tell me if and how it is possible to allow any Domain
User
(windows server 2003 std) the right to logon on to a Windows XP Pro
Machine. This seems like it shouldn't be too hard but i can't
figure
it out.

Right now, anytime I stage a new pc i have to go under Control Panel
|
User Accounts | Add User | type in the user name and domain | and
define the users group membership as Administrators in order to
allow
them to logon.

Realistically, it is not practical to perform these steps for each
user that will using this PC.

What i have tried.

I have tried going under the PC's Group Policies and changing the :
Local Computer Policy | Windows Settings | Security Settings | Local
Policies | User Rights Assignment | Log On Locally and adding the
'domain users' group but it doesn't alow me to add or remove any
item
in this field.

Also....

I went under the doman security policies looking to change a similar
setting but no luck there either.

Thanks for your help.....

~JH

Why not simply add the WinXP Pro computer to the domain? Then any
properly authenicated domain user will be able to log in without you
having to create local accounts for them. Ask you network or domain
administrator for assistance.

--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having
both at once. - RAH

 

[Frank Clark]

Yes, AD (ACtive directory) is such a wonderful thing. If you have
Server or advanced server and you create a domain by using DC promo
you get that functionality and more. then you join the workstations
to the domain, this can easily be done when you are setup the system
or can be scripted. Then if you want to limit who can logon to a
particular system AD U&C >> User Properties >> Profile >> logon to
(goes with logon hours). teadious to do by hand but can be scripted
which makes it less tedious if you have more than a hand full of
computers.
Local accounts should be limited to only those that need to be there -
- ie best case scenario -- local administrator. If you have apps
that don't play well and need local access you may need local
accounts for that to for the domain accounts.

Frank Clark
10/1/2004 7:49:58 AM

 

[Torgeir Bakken \(MVP\)]

Can anyone tell me if and how it is possible to allow any Domain User
(windows server 2003 std) the right to logon on to a Windows XP Pro
Machine. This seems like it shouldn't be too hard but i can't figure
it out.

Right now, anytime I stage a new pc i have to go under Control Panel |
User Accounts | Add User | type in the user name and domain | and
define the users group membership as Administrators in order to allow
them to logon.

Realistically, it is not practical to perform these steps for each
user that will using this PC.

Hi

We solve this by adding "NT Authority\Interactive" to the local
Administrators group to let all domain users automatically be local
admins when they log on to a computer interactively.

This is more secure than adding "Authenticated Domain users ",
"Domain Users" or "NT AUTHORITY\Authenticated Users" because you
avoid the issue with cross network admin rights (remote access)
that these groups introduces.