[jageorge72]

Hello! New here......:winking:

Here's my newbie question:

Running Windows 2000 at an A/E firm. Have a group called "structural", that has read access to a Standards directory.

If one user from that group was given Administrator access, would the other people in that "group" also get administrator access?

Or......does the person we want to give Administrator access need to be pulled from the "structural" group?

Thanks for any help!!

 

[pdecker]

I may be wrong because Im also new, but here is my input...

If you give a group admin rights, Any user within that group will receive administrative rights as well, however, windows tries to be safe so that if any of the users in that group are also in another group that is denied those administrative rights, then the deny will dominate for those users....

In other words it is safer to maybe create another group for users you will give admin rights to, and also ad this one user you want to have admin rights to this extra group. Then just give this extra group admin rights. As long as they arent denied rights in any other groups they should be fine! and this will keep your extra users away from having admin rights.....


....how many times can we say admin rights?:winkgrin:

hope this wasnt too confusing...

 

[pdecker]

um also, if you are just giving admin rights to the USER and not the group I dont think you have anything to worry about! Other users in the same group will not share the privilages pertaining to a specific user...

 

[jageorge72]

um also, if you are just giving admin rights to the USER and not the group I dont think you have anything to worry about! Other users in the same group will not share the privilages pertaining to a specific user...

That is correct. Just giving one USER from the group Admin access.

Thanks pdecker! Can anyone else confirm this?

 

[JAMMAN]

Definitely not, giving one user in a group admin rights only gives that user admin rights. If you are still worried give 'em their own group. You can assign any user complete control over any folder or drive without giving them admin over the entire domain also. Hell you can even deny admin access to folders from workstations that can only be changed at the server. The sky is the limit.