Any harm in changing a user's group membership?

[Bert Hyman]

I know that deleting a userid and creating a new user with the same name
will have really nasty results with ownership of objects, etc., but what
about simply changing the group membership?

I'd like to change a member of the "Administrator" group to "Power User"
or simply "User" for a while to see what (if anything) stops working,
but only if I know that I can always change it back if things get
strange.

 

[John John - MVP]

I know that deleting a userid and creating a new user with the same name
will have really nasty results with ownership of objects, etc., but what
about simply changing the group membership?

I'd like to change a member of the "Administrator" group to "Power User"
or simply "User" for a while to see what (if anything) stops working,
but only if I know that I can always change it back if things get
strange.

It won't hurt anything other than user rights conferred by group membership.

John

 

[SC Tom]

I know that deleting a userid and creating a new user with the same name
will have really nasty results with ownership of objects, etc., but what
about simply changing the group membership?

I'd like to change a member of the "Administrator" group to "Power User"
or simply "User" for a while to see what (if anything) stops working,
but only if I know that I can always change it back if things get
strange.

You shouldn't have any problem changing it, but remember you'll have to
login as an admin to promote it back to an administrator.

 

[Yousuf Khan]

I know that deleting a userid and creating a new user with the same name
will have really nasty results with ownership of objects, etc., but what
about simply changing the group membership?

I'd like to change a member of the "Administrator" group to "Power User"
or simply "User" for a while to see what (if anything) stops working,
but only if I know that I can always change it back if things get
strange.

I've seen sometimes that certain programs do not start when a user is
running in non-administrator mode. Usually it's things in their startup
that give these kinds of problems.

Yousuf Khan

 

[John John - MVP]

In John John - MVP


I changed my own group membership to "Power User."

The first thing I noticed was that during the login process, some
malformed, incompletely drawn window popped up and stayed stuck in the
middle of the screen. There wasn't enough content for me to indentify
it.

In Task Manager, the only running application was "Visual C++ runtime
library" (quoting from memory). Nothing showed up in the process list
that caught my attention. I could drag the window around, and after
clicking in the spot where the "X" to close button should be, it went
away.

Then, I saw that the "Quick Launch" section of the toolbar was empty,
although the blank space appeared to be the same size as it had been
when populated. Attempts to put things into that space got me an error
to the effect that I couldn't create shortcuts there and would I like to
put it on the desktop instead.

That was enough for me to change my group membership back to
Administrators until I've done some more research.

These things were setup while the user had administrative privileges,
when you demote the account some of these things no longer work due to
insufficient rights.

John

 

[John John - MVP]

In John John - MVP


Does that mean that a new set of privileges are applied to an individual
user whenever the group membership is applied?

A new set? No, not new, the user will retain his Creator/Owner rights
or other rights that were explicitly granted to him but he will lose
rights conferred by group membership, for example Administrators have
Full Control on the Windows folder, Power Users don't.

But on reflection, that wouldn't cover the problem with the Quick
Launch bar, since I'd hope that a "Power User" would have rights to
modify his own.

So, are there then permssions on each object that a user creates that
are somehow more restrictive than the rights that come with group
membership, so that even though a "Power User" can create and use the
Quick Launch bar in general, he can't use or modify this SPECIFIC Quick
Launch bar?

What object and permissions control the ability of a "Power User" to
modify a Quick Launch bar created for that same user when he was in the
"Administrators" group?

He should have full control on this (Quick Launch) as it is kept in his
profile folder

If the entire system is filled with little permission-related landmines
like this, I think I'll wait to make more reasonable group assignments
until I build my next system

Glitches are common when users are demoted. You can try creating a new
account and make it a member of the Power Users group then try copying
the old profile over to the new account and see how things go. In any
case, as the old saying goes, Power Users are administrator who haven't
yet made themselves administrators...

John