Delete "Domain Users"

[nitingulati]

Hello All,

I have a domain, and i want to delete the Predefined Built-in local
security group "domain users"

I have following questions:
1. Can i delete such security group?
2. What are the implications that I can face?
3. Will i be able to create new users?

Any inputs/link will be of great help.

Regards,
Nitin

 

[Paul Bergson]

I do not believe this group can be deleted and if it could would be a
mistake. The built in groups can be used by the o/s, don't delete it.

http://support.microsoft.com/default.aspx?scid=kb;en-us;243330

--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[nitingulati]

Hi,

Okay,

1. So lets say I want to create a user but i don't want it to be the
part of Domain Users. How can i do that?
2. How does a user gets added to "Domain User" group? Do we have any
Domain Policy setting that does that?

Regards,
Nitin

 

[Hank Arnold]

Why do you want to keep them out of the "Domain Users" group? You are
creating a user that in part of the domain....

 

[Nitin]

there is no specific reason its just that i want the user to be outsite
the Domain Users group.

 

[Hank Arnold]

Then leave it as it is defined and move on...........

 

[Nitin]

hey that doesn't solve my purpose. neither does it answer my query...

 

[Paul Bergson]

Domain user is an interactively populated group that gets populated
everytime a user is created and placed in the domain.

--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Nitin]

is it defined anywhere or are there any settings that adds a user
"Domain Users" group by default because i don't want a user to be part
of Domain User group

 

[rwh]

In the account setup's Group Membership, change the primary group, then
you will be able to remove the Domain Users group from it's group
membership. It's not suggested but that's the way to do it.

 

[Nitin]

... currently i am using windows 2000 as the AD server can you please
help to find out the exact path for this group membership because i am
looking for it in Domain Security policy and Active Directory Users and
computers.

 

[Cary Shultz [A.D. MVP]]

Nitin,

I might want to stay away from this. I know that this does not answer your
question. Also keep in mind that the 'Domain Users' security group is a
member of the computers local group USERS.

If you want to remove specific users from this group then you need to make
sure that you add them to another group ( with this 'another group' being
the 'new' primary group ).

As to how and why this is set up this way ( all Domain user account objects
being a member of the Domain Users group ) I will have to look into it. I
have a few ideas, though. Just want to check into them first....

--
Cary W. Shultz
Roanoke, VA 24012

WIN2000 Active Directory MVP
http://www.activedirectory-win2000.com
(soon to be updated!!!)
http://www.grouppolicy-win2000.com
(soon to be updated!!!)