Totally frustrated

[DC]

Question 1.
Does anyone know of a good place to find tutorials, help etc.
configuring 2000 Advanced_server.

I inherited the task to System Admin.
I'm just trying to take domain admin rights away from a couple users without
all hell braking loose.
My last post to this question was no help maybe a guru out there will feel
sorry for me and help.
I'll not a newbee I've been using NT since it first came out.

Question 2.
After taking away domain admin rights from a 2000 user,
the next login starts a new profile. How do I get the old one back?
As suggested in my last post "why not just copy the contents of the old
profile into the
new one and be done with it?"
This works great for recovering desktop/favorites etc.
BUT WHAT ABOUT THE PROGRAM INFORMATION.
IE, Outlook, all our other apps act like they were just installed.
How do I get it ALL back?
I tried changing the path to my profile in the registry but this created
even more problems.

Question 3.
How do I allow my accounting dept to change their system time or date
without making them domain admins?
I went to Domain Controller Security Policy/User Rights/Change the system
time and added domain users on my server but they are still not able to
change their time.

I've spent too many hours on what should be a simple change.
Hope someone can help.

 

[Salt_Peter]

Question 1.
Does anyone know of a good place to find tutorials, help etc.
configuring 2000 Advanced_server.

I inherited the task to System Admin.
I'm just trying to take domain admin rights away from a couple users without
all hell braking loose.
My last post to this question was no help maybe a guru out there will feel
sorry for me and help.
I'll not a newbee I've been using NT since it first came out.

Question 2.
After taking away domain admin rights from a 2000 user,
the next login starts a new profile. How do I get the old one back?
As suggested in my last post "why not just copy the contents of the old
profile into the
new one and be done with it?"
This works great for recovering desktop/favorites etc.
BUT WHAT ABOUT THE PROGRAM INFORMATION.
IE, Outlook, all our other apps act like they were just installed.
How do I get it ALL back?
I tried changing the path to my profile in the registry but this created
even more problems.

To remove domain admin rights from a user account, there is no need to
recreate the said account, just modify it's group membership. That said, any
programs needing local admin rights would still require the user account to
have admin rights local to the station.

Question 3.
How do I allow my accounting dept to change their system time or date
without making them domain admins?
I went to Domain Controller Security Policy/User Rights/Change the system
time and added domain users on my server but they are still not able to
change their time.

I've spent too many hours on what should be a simple change.
Hope someone can help.

This is not so simple, time is crtitical in a W2K environment. The PDC
emulator on a W2K domain is the authoritative time keeper on that domain. It
replicates the official time throughout the domain. Kerberos and logins are
time stamped as well as AD replication sequence numbers. Time is more
critical to W2K than a heartbeat for humans (that's putting it lightly).

In my opinion, any application that requires time modification procedures
are not W2K compliant. If the application doesn't provide a method to change
it's own timestamp parameters, as in this case, changing the OS time is not
an option. The reason is simple, a user can't log on without having a finite
time skew (usually 5 minutes). Time is fundamental in the W2K world.