Let me begin by stating up-front that I am not an IT by choice; I run an aquarium business and am self-taught in Windows and Win Server so do not necessarily understand all the lingo, but am learning by leaps and bounds. Guess Im saying please take it easy on me and you may need to explain some terminology. Thanks for that in advance. :-)
We have one Windows Server 2003 R2 SP2 set up as a domain controller, WINS server, DNS server and Active Directory. We have nine clients running XP SP2 which are all new installations. We have no policies enforced yet for domain or user groups. The defaults are linked but not enforced.
We were using QuickBooks Enterprise 6.0, which required all QB users to be administrators in AD in order to use the software when running it in a domain/client network. You also had to be careful defining GPOs so I never enforced them, only link-enabled them. I know, thats a security nightmare and IT WAS, with some idiot users installing all kinds of nasty spyware-infested apps all the time. Drove me nuts!
This problem of having to make QB users Admin. was addressed in the latest QB Enterprise 8.0 version, so now QB users can be users. Unfortunately, that version also required us to upgrade from W2000 to XP on all clients. All our users need to run QB.
So now after installing XP and getting it all configured, Im running into major problems trying to convert from administrators to users. Heres what Ive tried so far:
Removed administrator from each users membership and the one security group I had them all in. I set each user account to take ownership of roaming profile folders. I logged into each client as a local admin and changed the user type on each XP machine to restricted user (trying to avoid power user so my employees cant install junk like Google toolbars).
I rebooted each client and go the Local policy prohibits logging in interactively warning when trying to login.
Problem is, you cant edit the local policy in XP even when logged in as an Admin (local or domain). There is no mention of the need to change local policy on clients in everything Ive read in the many Win Server 2003 books Ive studied, so not sure if it needs to be changed anyway. Doesnt make sense as XP Pro is NT, right?
I know its a permissions or GP thing. I did try running from the cmd line:
runas /user:administrator mmc.exe, then opened up the GP Editor snap-in but User Rights Assignment is still locked.
Help! :-)
Start Free Trial
