Link to home
Start Free TrialLog in
Avatar of -exptechnical
-exptechnical

asked on

Chagning Users' Primary Group from Domain Users to other group (Active Directory)

I created a new contractors group and created a new user for this group.  I need to make the contractors group their primary group rather than 'Domain Users.'   The option to make this change is greyed out however.  I just need to make the change for this user.  Thanks in advance-

Avatar of kzabbott
kzabbott
Flag of United States of America image

Dumb question, but is the new "Contractors" group a Universal Security Group?  If not, change it to a Universal Security Group and you should then be able to change the Primary group by taking the following steps:

Log on as Domain Admin
In ADUC, right-click the user and select properties
Select the "Member Of..." tab
Highlight the Contractor's group
Click on "Set Primary Group"
ASKER CERTIFIED SOLUTION
Avatar of Brian Pierce
Brian Pierce
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
KCTS, while what you say is true, exptechnical only indicated a desire to change the primary group - that can be done.
OK Looks like I am ingorant on this - I have not met this before despite quite a lot of experience with Win2000/2003 and Active Directory. What is the Primary Group - what is its function?
KCTS, I'll have to plead ignorance myself.  Despite an MCSE and 6 years working with AD, I don't know the answer to your question; I just know that the primary group can be changed.  Oh, and one CAN remove a user from the Domain Users group, as long as a different group is set as primary; try it with a test user.

The one other thing, which is actually to the point of this user's question:

to enable the changing the Primary Group, you will probably need to click on View and select Advanced Features from the ADUC snap-in menu.
OK - having just written that, I had to find the answer which I just found on TechNet:  
Full page is here: http://snipurl.com/1p480

Exerpt:

The user's primary group applies only to users who log on to the network through Services for Macintosh or to who run POSIX-compliant applications. Unless you are using these services, there is no need to change the primary group from Domain Users, which is the default value.
 
" Setting the user's primary group membership to a value other than Domain Users may adversely impact performance as all users in the domain are members of Domain Users. If the user's primary group is set to another group, it may cause the group membership to exceed the supported maximum number of members.
 
Thanks for that, I actually found that link while I was looking for a solution myself. I happen to be a Windows 2000 and 2003 MCSE as well and have extensive systems management experience as well but and I've never come across this before and an still at a lost as to exactly What its funnction is? - Perhaps I'll post it as a stand-alone question and see what the response is.
No problem; thanks for being gracious about it -  I know (from your profile!) that your experience and knowledge far surpasses mine.  I'd love to find out out the response to your question, too  -  that's one of the things I love about our business  - always something new to learn!  
And that comment solved the initial problem how?
ok here is the thing,

First, the solution marked here is wrong
second, you can make a user be not member of domain users group
third, you can only set a group be a primary group only if the group is a security group and not a distribution group

good day to all, I say good day