[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 7080
  • Last Modified:

Chagning Users' Primary Group from Domain Users to other group (Active Directory)

I created a new contractors group and created a new user for this group.  I need to make the contractors group their primary group rather than 'Domain Users.'   The option to make this change is greyed out however.  I just need to make the change for this user.  Thanks in advance-

0
-exptechnical
Asked:
-exptechnical
  • 5
  • 3
  • 2
  • +1
1 Solution
 
kzabbottCommented:
Dumb question, but is the new "Contractors" group a Universal Security Group?  If not, change it to a Universal Security Group and you should then be able to change the Primary group by taking the following steps:

Log on as Domain Admin
In ADUC, right-click the user and select properties
Select the "Member Of..." tab
Highlight the Contractor's group
Click on "Set Primary Group"
0
 
Shift-3Commented:
0
 
KCTSCommented:
You cannot move users out of the Domain Users group. This is a special group with dynamic membership, as soon as someone is authenticated by AD they become a Domain User, when the log out they are effectively removed from Domain Users.

You cannot control who is in the domain users group - and it should not be necessary anyway.

0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
kzabbottCommented:
KCTS, while what you say is true, exptechnical only indicated a desire to change the primary group - that can be done.
0
 
KCTSCommented:
OK Looks like I am ingorant on this - I have not met this before despite quite a lot of experience with Win2000/2003 and Active Directory. What is the Primary Group - what is its function?
0
 
kzabbottCommented:
KCTS, I'll have to plead ignorance myself.  Despite an MCSE and 6 years working with AD, I don't know the answer to your question; I just know that the primary group can be changed.  Oh, and one CAN remove a user from the Domain Users group, as long as a different group is set as primary; try it with a test user.

The one other thing, which is actually to the point of this user's question:

to enable the changing the Primary Group, you will probably need to click on View and select Advanced Features from the ADUC snap-in menu.
0
 
kzabbottCommented:
OK - having just written that, I had to find the answer which I just found on TechNet:  
Full page is here: http://snipurl.com/1p480

Exerpt:

The user's primary group applies only to users who log on to the network through Services for Macintosh or to who run POSIX-compliant applications. Unless you are using these services, there is no need to change the primary group from Domain Users, which is the default value.
 
" Setting the user's primary group membership to a value other than Domain Users may adversely impact performance as all users in the domain are members of Domain Users. If the user's primary group is set to another group, it may cause the group membership to exceed the supported maximum number of members.
 
0
 
KCTSCommented:
Thanks for that, I actually found that link while I was looking for a solution myself. I happen to be a Windows 2000 and 2003 MCSE as well and have extensive systems management experience as well but and I've never come across this before and an still at a lost as to exactly What its funnction is? - Perhaps I'll post it as a stand-alone question and see what the response is.
0
 
kzabbottCommented:
No problem; thanks for being gracious about it -  I know (from your profile!) that your experience and knowledge far surpasses mine.  I'd love to find out out the response to your question, too  -  that's one of the things I love about our business  - always something new to learn!  
0
 
Shift-3Commented:
And that comment solved the initial problem how?
0
 
efusionCommented:
ok here is the thing,

First, the solution marked here is wrong
second, you can make a user be not member of domain users group
third, you can only set a group be a primary group only if the group is a security group and not a distribution group

good day to all, I say good day
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 5
  • 3
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now