- icacls c:\ /remove "users" from elevated prompt (although UAC is disabled) gives access denied - psexec -s icacls c:\ /remove "users" gives access denied (so running as SYSTEM) - Modifying permissions through GPO, either local or through domain doesn't work, permissions aren't applied (probably also access denied)
How do I grant all the power users on our Server 2003 network the ability to install and remove programs as well as use of the system configuration utility (= run-> ms config)? They need these local rights on their workstations (XP and Vista). Either by using a "NET LOCALGROUP" startup script or with Restricted Groups in Group Policy.
The member attribute of Domain Users is often empty. Instead, the primaryGroupID attribute of the user (or computer) indicates the "primary" group. The value of primaryGroupID is the RID of the primary group. That's why you don't need to worry about how many members are in the Domain Users group.
Used to be that if I browsed to C:\Users, I saw my user folder along with Public, etc. But now, I not longer see my user folder or All Users unless I unhide "Protected operating system files".