Effective Rights

[Pat]

is there a command line option to run on a user workstation to find
out thier effective rights on our domain?

 

[Keith W. McCammon]

Do you want to determine rights for a user, or for a computer? You need to
make that determination first.

There are a few resource kit tools that allow you to view group membership
and group policy results:

global.exe
gpresult.exe
perms.exe

Some of this can also be done with cacls and xcacls.

 

[Pat]

thanks for the response Keith

Do you want to determine rights for a user, or for a computer? You need to
make that determination first.

There are a few resource kit tools that allow you to view group membership
and group policy results:

global.exe
gpresult.exe
perms.exe

Some of this can also be done with cacls and xcacls.

 

[Pat]

Keith,
I notice a normal user account can remote manage me server, they are
part of the usersdomanin users grp and our group policy group. What
might I look at to see where they are picking up the rights to do
this. I looked in the security tab of the domain users and
Administrator and domain admins are there, if I create a new user the
same security is applied. is this normal?

 

[Keith W. McCammon]

So your domain users are members of the domain admin group? If that's what
you're describing that is highly unusual.

 

[Pat]

no exactly, what I meant is all my users are part ot the domain users
group. in the user properties under security are the Administrators
and domain admin groups, along with, Enterprise Admin. etc. I notice
with a new user, I can go to a desktop and connect to a server to with
computer management in mmc. what rights would be giving this to the
user.