permission from memeber server

[saradrb]

I have a DC and two member servers on W2k. I want to add
the local administrator of those 2 member srv into a
group in AD but i can't locate them in the ad. AD only
shows users in AD and not users in member servers. This is
a bit diff from NT 4. However, if I add the computer i.e
member server into the a particular group, does it imply
that the local users/admin of the member server is added
too??

 

[Tim Hines [MSFT]]

A local user account cannot be added to a domain group but you can add a
domain group to a local group. Adding the machine account to a group does
not add the local admin to that group.

--
--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[saradrb]

Got that. But I'm configuration a domain policy that needs
all users ie domain users and local users to log on
locally coz the apps is on a DC (don't ask why) and that
apps is on terminal services. So users have to logon to
the DC. U may ask me to configure the default DC policy
but I'm having some problems with that. I get an error
describing that i do not have appropriate rights to open
that policy and the system cannot find the path specified.
So I have to config the default domain policy and config
the Log on locally option to add all domain users and
local administrators of member servers. Is there a
workaround for this.

 

[Tim Hines [MSFT]]

You can create a new group policy object and link it the domain controllers
OU. In that policy you can give the users the right to logon locally. You
should not specify that policy setting in the default domain policy because
that gives all users the ability to log on to every server and workstation
in your domain

You may want to look at the article below in regard to the error editing the
default DC policy.
http://support.microsoft.com/default.aspx?scid=kb;en-us;253268&Product=win2000
--
--
Tim Hines, MCSE, MCSA
Windows 2000 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.