Using Net Group or GPO to add member to Power User Group

[OJ]

How can I add a domain account to be a member of a power
user group in all my Windows 2000 Prof.

Appreciate if somebody can assist

 

[Cary Shultz [A.D. MVP]]

OJ,

Please take a look at Restricted Groups GPO. This question has been asked
and answered many times in the last few days ( but probably more often in
the Group Policy news group! ). Please take a look at the following MSKB
Article:

http://support.microsoft.com/?id=320065

Please note that you would simply replace 'Administrators' with 'Power
Users'.

Also, and this is important, you need to know that the Restricted Groups GPO
will flush the current members of your 'focus' group ( in your case, the
local Power Users group ) and then add your created group. This may or may
not be acceptable to you.

There is a way to change this behavior. Please take a look at the following
MSKB Article:

http://support.microsoft.com/?id=810076

You would have to call MS-PSS ( the call is free if you give them this MSKB
Article ) to get the WIN2000 patch and the WINXP Pro patch. Apply it to all
of your computers and then create the Restricted Groups GPO. Now, instead
of flushing and loading - as I like to call it - it will simply add your
created group to your 'focus' group ( again, the local Power Users group ).

I mentioned earlier that the out-of-the-box Restricted Groups GPO will flush
and load. If your 'focus' group is the local Power Users then this will
probably not cause any problems. However, if your 'focus' group is the
local Administrators group then this could cause a problems. Why? Because
the Domain Admins group is added to the local Administrators group on each
and every WIN2000 and WINXP Pro system. If you were to use the RG GPO and
apply this to the local Adminsitrators group then you would flush out all
the current members ( including the Domain Admins ) and replace it with your
created group ( HelpDesk or something like this ). So, the fix to this
situation is to add both your created group as well as the Domain Admins....

Also, please follow the steps closely. There are a lot of people who claim
that they can not get this GPO to work. They didn't read the directions
very well. You do the first two steps on the Domain Controller and then you
M U S T do everything thereafter on a WIN2000 system that has the Adminpak
installed! Well, I would contend that you could do the whole thing from a
WIN2000 system with the Adminpak installed.......

HTH,

Cary

 

[Guest]

You can do it manually with the below command at the command line or in a
batch file:


net localgroup "power users" /add *group or username*

Brandon Banis
MCSE: Security, MCSA, CCNP, CCDA & Security +