Problem after removed "domain users" from "local administrator"s g

Hello all,

We are running SBS 2003 SP1 Premium with approx 14 workstations running
Windows XP Pro SP2.

We finally decided to remove the "domain users" group from the "local
administrators" group on the workstations and since doing that we have a
strange problem happening.

The users can log on the network successfully but then they can not start
any programs - as soon as I reverse this setting everything is fine again.

This does not make sense to me - has anyone come across this before? We
want this setting to tighten up on security...so users can no longer install
applications, etc.

If anyone has any suggestions on how to fix this that would be great!!

Thanks so much in advance!
Tammy

Cliff
Thu Jul 10 02:38:59 PDT 2008

I've done this for several clients without problem. Could you post more
specifics? What program? What the error is? Are there event log entries
that provide more info?

-Cliff

"Tammy" <Tammy@discussions.microsoft.com> wrote in message
news:89F04536-7640-4D46-9193-81EFAC8A90C3@microsoft.com...
> Hello all,
>
> We are running SBS 2003 SP1 Premium with approx 14 workstations running
> Windows XP Pro SP2.
>
> We finally decided to remove the "domain users" group from the "local
> administrators" group on the workstations and since doing that we have a
> strange problem happening.
>
> The users can log on the network successfully but then they can not start
> any programs - as soon as I reverse this setting everything is fine again.
>
> This does not make sense to me - has anyone come across this before? We
> want this setting to tighten up on security...so users can no longer
> install
> applications, etc.
>
> If anyone has any suggestions on how to fix this that would be great!!
>
> Thanks so much in advance!
> Tammy

v-robmen
Thu Jul 10 03:31:45 PDT 2008

Hello Tammy,

Thank you for your post.

Please allow me to confirm that my understandings are correct. As I
understand it, the issue is:

After you have removed the "domain users" group from the "local
administrators" group on the workstations and since then users can log on
the network successfully but they cannot start any programs. As soon as you
reverse this setting everything is fine again.

If I have misunderstood your concerns please feel free to let me know.

Before we move on, I'd like to ask:

1. Does this issue occur on every workstation now? Is the error symptom
exactly the same?
2. What error message when they cannot start any programs?

This is indeed a strange issue if you only remove the "domain users" group
from the "local administrators" group on the workstations.

At this point, I would like to suggest you check and make sure
"<yourdomainname>\Domain Users" group has been listed under the local
"Users" group on the client computer.
However, if the "<yourdomainname>\Domain Users" group has been listed and
issue persists, please try to take ownership of C:\ to domain user.

About how to take ownership of a file or folder, you may refer to following
KB article:

How to take ownership of a file or folder in Windows XP
http://support.microsoft.com/default.aspx?scid=KB;EN-US;308421
Note: the steps in this KB article also apply to Windows server 2003.


If we cannot resolve the issue after we perform the above steps, please
help me collect some information for further investigation:

Information Need
==============
1. Check event viewer for related information, if there are anything
related "Access Denied" etc, please help save it to *.evt and send to me at
v-robmen@microsoft.com
2. If possible, please capture some screenshot when the error messages
appear and send them to me : v-robmen@microsoft.com


Hope this helps. Also, if you have any questions or concerns, please do not
hesitate to let me know.

Thank you for your time and cooperation


Best regards,

Robbin Meng(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Joe
Thu Jul 10 12:24:53 PDT 2008

Tammy wrote:
> Hello all,
>
> We are running SBS 2003 SP1 Premium with approx 14 workstations running
> Windows XP Pro SP2.
>
> We finally decided to remove the "domain users" group from the "local
> administrators" group on the workstations and since doing that we have a
> strange problem happening.
>
> The users can log on the network successfully but then they can not start
> any programs - as soon as I reverse this setting everything is fine again.
>
> This does not make sense to me - has anyone come across this before? We
> want this setting to tighten up on security...so users can no longer install
> applications, etc.
>
> If anyone has any suggestions on how to fix this that would be great!!
>
> Thanks so much in advance!
> Tammy

There's more than one possible reason. Some programs simply cannot be
used without administrator privileges, ever, which is an excellent
reason to switch to software written by competent people.

Some just need one initial access with admin privileges, after which an
unprivileged user can run them. Some, if not all, Microsoft Office
programs fall into this group. Each user of the software needs to run it
once on each machine, with admin privileges. Clearly this isn't the
answer in this case.

I've just come across a third type, where the program would work
properly for an unprivileged user on a stand-alone computer but not on a
domain member machine. In the case of Sage Accounts 50, the user
requires read/execute privileges on a couple of files under Program
Files, again just once. The Sage installer did set up those privileges,
but for the computer Local User group. Domain computers don't have local
users, so nobody could run these files. The right answer, in hindsight,
was to add Domain Users to the Local Users group. I used the usual
brute-force-and-ignorance technique.

It's worth trying that (the right answer) in your case, it might solve
the problem. I've never heard of that as being something that
connectcomputer does, but it's worth bearing in mind in future when
commissioning new workstations.

If that doesn't work, it's probably a matter of getting onto the
software vendors, and asking what has to be changed for unprivileged
users to run their products, possibly hinting gently that if it can't be
done, that's the last version of their software you will consider. There
are probably a few file permissions that need to be altered to fix the
problem, if they haven't been totally incompetent.