I'm running a 2003 SBS running Active Directory. My clients have notebooks and authenticate to the domain via the DControllers in my network. When logged into the domain they are unable and/or locally on their notebooks, they are unable to run some .exe files and get an error. For example, one of my guys got a virus and I put the .exe removal tool on a shared drive, when my user went to run it he got an error saying he needs an Administrator to run it. I don't want that, i'm thinking I screwed up somewhere in my AD Users & Computers. What builtin group do they need to be members of? They are already local Administrators of their notebooks however I think the DC Policy's over-ride it???