assigning users to the Power users group via Group Policy

[Mo Childs]

Can anyone tell me how I can assign users to the Power Users group on
all workstations in our site via Group Policy or if that isn't possible
is it possible to assign the same rights as a power user through group
policy

Thanks for any help

 

[Derek Melber [MVP]]

Use the Restricted Groups option in the Computer Configuration portion fo
the GPO. The Power Users won't show up as a group most of the time, since
you are configuring from a DC, but you can type in any group name.

 

[Mo Childs]

Thanks for that help, it was just what I was looking for

 

[David Everett [MSFT]]

You can assign a Global Group to the Power Users group using the Restricted
Groups policy setting.

Just follow the steps outlined in 320065 with the following exceptions where
Windows XP workstations are used to configure the policy.

- For Step 8 you will need to click the Locations button and select the
local machine name.
- For Step 10, after you click Browse, you will need to click the "Object
Types..." button and place a check next to Groups.

NOTE: Use of Restricted Groups does not append to existing users or groups
already listed in the Power Users group, it overwrites them. So, if any
users or groups already exist in the Power Users group you will want to make
sure and add them in Step 11 as well.

FYI: The Power Users group is not a valid group on DCs. Don't set Power
Users in a Restricted Group at a level that will apply to the DCs because
the DC may see Power Users as a SID (unresolved name) and policies may fail
to apply to the DCs.

320065 How to Configure a Global Group to Be a Member of the Administrators
http://support.microsoft.com/?id=320065

 

[Mo Childs]

Except it doesn't appear to work.

I can't figure out how to perform Step 8, it isn't possible apparently to
set focus to the local machine, only Domains and OUs. It is possible to type
in "Power Users" though and then add Domain Users to this group but this
doesn't seem to have the desired effect of adding Domain users to the local
Power Users group on workstations in the OU.

 

[David Everett [MSFT]]

Are you performing Step 8 from a workstation/member server, or from a DC?
Starting at Step 4 you need to complete the remaining steps from a
workstation/member server that has the Adminpak installed.

NOTE: If you are doing this from a Windows XP workstation you need to do the
following on Step 8:

Click Add Group
Click Browse
Click the Locations button
Select the local workstation

Also, for Step 10

Click ADD
Click Browse
Click the "Object Types..." button
Place a check next to Groups
--
David Everett
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Mo Childs]

I was rushing to much and not checking enough I'm on Windows XP and I think
I have issues relating to this
http://support.microsoft.com/default.aspx?scid=kb;[LN];810907 the GP is
working on Windows 2000 workstations however.

NowI still can't get Step 8 to work as written, I can't select the local
workstation from the browse list. I am working on the workstation. I do have
the adminpak installed and I also have Group Policy Management tool
installed. It is possible to just eneter the group manually and it is
resolved correctly if you do.

Regards

 

[David Everett [MSFT]]

I think I see what you are encountering. If you already have a Group listed
to the right of Restricted Groups and you are trying to add to "Members of
this group" then you do not see your workstation.

However, if you right-click the Restricted Groups node and select "Add
Group..." click Browse then click Locations you should see your workstation
at this point. After selecting your workstation you can type in power users
and Check Names should resolve this.

The groups listed to the right of Restricted Groups are not domain groups,
they are machine groups that you are adding domain members to.
--
David Everett
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.

I was rushing to much and not checking enough I'm on Windows XP and I think
I have issues relating to this
http://support.microsoft.com/default.aspx?scid=kb;[LN];810907 the GP is
working on Windows 2000 workstations however.

NowI still can't get Step 8 to work as written, I can't select the local
workstation from the browse list. I am working on the workstation. I do have
the adminpak installed and I also have Group Policy Management tool
installed. It is possible to just eneter the group manually and it is
resolved correctly if you do.

Regards

Are you performing Step 8 from a workstation/member server, or from a DC?
Starting at Step 4 you need to complete the remaining steps from a
workstation/member server that has the Adminpak installed.

NOTE: If you are doing this from a Windows XP workstation you need to do
the
following on Step 8:

Click Add Group
Click Browse
Click the Locations button
Select the local workstation

Also, for Step 10

Click ADD
Click Browse
Click the "Object Types..." button
Place a check next to Groups
--
David Everett
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no
rights.