Over 1 million tech questions and answers.

Local Users group empty generates problems

Q: Local Users group empty generates problems

Hi all,

I am deploying a solution based on Windows 7 computers. These computers use the same sypspreped clonezilla image. For these computers, we must restict access to specific domain users with admin privileges. To do that, after domain integration, we add nedded
domain users in the local administrators group and we delete the default domain users group from the local users Group.

This works fine on several PCs (approximately 25) but on one computer I have a strange issue. When I try to connect on this computer with the local administrator account, I have no problem, everything is working fine. When I try to open a session with a domain
user who is in local administrator group, I have the welcome message, blue background from my desktop, but nothing launches. If I make ctrl + alt + del, I can click on Task Manager but it never launches ...

I have dragged the computer from the domain and made a new domain integration from this computer in the domain. This fixed the problem for several days, but now I'm enoutering the same problem ...

If I add domain users group in the Local Users Group, the problem seems to be fixed. But, for security reasons, I cannot apply this solution. For the moment I took all groups included in the local admin groups and added them in the local users group. The specific
domain users can now open a session on the computer ...

Have you ever seen this case anywhere else ? I don't think that having the same domain group in two local groups is a good practice, so if someone has another purposition of solution (instead of a new OS installation), I would be interrested.

Read other answers
Preferred Solution: Local Users group empty generates problems

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)


Hello, I have a problem on my Windows 7 Professional machines restored from an Acronis 11.5 backup where I have a local Security Group "myGROUP" lists several members as unresolved SIDs: S-1-5-21-aaaaaaaaaaaa-bbbbbbbbb-ccccccc-1234. I need to delete
"myGROUP" but when I try to I get the error "The specified account name is not a member of the group."
It appears to be associated with the unresolved user, because I then proceed to remove the SID and hit apply to which I get the same error as before.

I've tried using CMD and Powershell to delete with no success. I've tried deleting the Unknown User profiles. I've looked in the registry to see if I can find the user profiles in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ but they
are not listed.
I did however notice that the SID listed in the membership of "myGROUP" was similar to one listed in the ProfileList as the start and end were the same but the middle strings were different:
Unresolved SID: S-1-5-21-aaaaaaaaaaaa-bbbbbbbbb-ccccccc-1234
ProfileList SID: S-1-5-21-dddddddddd-eeeeeeee-fffffff-1234
Could the Acronis restore have changed the SID of my user thus corrupting the local group? Is there any way to fix this?

Read other answers

So In all my searching I can't really find a workaround for this. I have a domain and plenty of domain users but I have one department that remains local user accounts. All I want to do is set the default homepage for these 47 domain connected machines.
So with domain users I can use loopback policy to apply the user gpo settings to any computer in those specific OU's.  But that simply will not apply to local accounts.  Any other thoughts on how to make this work centrally?  Not super interested
in doing one by one.
thanks in advance.

Edit: I did try pushing a registry setting via the computer config but doesn't seem to be taking.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
?Start Page?=?http?

Read other answers

Hey guys, I've searched around on the internet for a resolution to this problem and the best I've found is a couple of posts on other forums describing this problem but no solution. The other guys were running Windows 2000 I think, not Vista.

When attempting to view the members of the local administrators group I see
no users at all, even when in the context of the local administrators
account. If I attempt to add an account to the group that I know is in there
already, I receive the following message:

"Username" is already a member of group "Administrators".

I've also tried running a vb script to enumerate the users in local
administrators group and this returns no results. (Can provide the code if required).

I knocked up a C# app that calls NetLocalGroupGetMembers but this returns 87 (ERROR_INVALID_PARAMETER) when the groupname parameter = "administrators". When groupname = "users" the function returns 0 (ERROR_SUCCESS), indicating that it is succesful.

Any ideas how I can resolve this?

A:No Users in Local Administrators Group

Hi -

Try this & see if it brings names/ additional info out for you:

Bring up an elevated admin cmd/DOS prompt -
START | type cmd.exe into the start search box | right click on cmd.exe | select run as administrator | paste the following in (right-click at top of DOS screen, select Edit, select Paste) -

whoami /all > %temp%\w1.txt & start notepad %temp%\w1.txt
Regards. . .



Read other 7 answers

Here's my situation. I've got a computer that's shared by several people (in a small church library), which I'm trying to lock down in a controlled fashion.

The system is running Windows XP Professional. In addition to the administrator account, I've created one restricted account for the librarian, which is password-protected, and one restricted account with no password for everybody else. It's a stand-alone computer -- no domain, no domain controllers, no active directory.

I've successfully implemented a local group policy which prevents users from doing things like changing screen resolution, screen saver settings, etc. But I'd like to have this restriction apply only to the one "everybody" account, and not to the other accounts, and I haven't been able to figure out how to do this. Is it possible? What are the steps involved?


A:Local group policy -- how to select users?

Hello, Tom, and welcome to TSF. If the "open to everyone" account is used by really numerous individuals, of varying levels of IT competence, then I would strongly suggest you take some time and have a look at a utility provided gratis by Microsoft, the Shared Computer Toolkit for Windows XP. Invest some time to browse all the area I've linked for you, and please post back if you really think this is what will effectively help you keep this computer under your control, your way, all the time.

Read other 3 answers

Hi all. This may be the most basic of all questions but here's the thing. I always thought that if a user was in the Users group, and not in the Administrators local group on a Win 7 Pro machine, they could not install/uninstall applications.  This
is evidenced by the fact that I set users to jus Users, and upon forgetting to set one to Admin temporarily to install something, I almost always fail to be able to install that something, which is expected.

Yet from time to time, I remote to a Win 7 Pro system and find that something got installed, most recently it was DropBox.   Confirming that the user is just in Users, I went to Programs & Features and was able to uninstall

My theory is that if a person installs a program to just the user's profile somehow, and not try to install it to the computer (All Usres Of This Computer), maybe that's what's happening here.  Otherwise I'm at a loss.  I figured I'd cut the research
time short by just asking here rather than investigate this obscure subject on Google.  Thank you. 

Read other answers


I've recently notice a strange username in the user accounts list. The username is


and it's under the administrator's group. Anyone have an idea what this might be?


A:Strange username in Local Users and Group

Certainly looks suspicious... run Malwarebytes scan and see what comes up...

Read other 2 answers

I have been regularly deleting those empty folders. Not a big deal, just annoyance.
How did that happen ?
Someone had suggested that it has something to do with WLM. If so, anyway to stop them from appearing under Local ?
IF WLM does not cause that, then what causes that ?


A:C:\users\username\Appdata\Local ....... empty folders

It is WLM that creates these. I don't think there is a way to stop it. I just delete them when they get enough to annoy me.

Read other 6 answers


Does anyone know how to exclude a user from accessing anything on
a local computer , but still be able to use a shared program from that
machine? IE. not be able to see the computer or folder through
my network places or through computer management "shares" folder
or be able to change any settings on the aformentioned machine?
Basically, I want to share a program but not have that user have the
ability to change anything on this "server". It is a peer to peer setup
with XP pro running on all machines. I have tried everything from
sharing and security - but it is my understanding that a Group Policy /
Local Policy should be setup for this machine which would prevent access?

Any help would be greatly appreciated.

graham neil

A:Local Group Policy - program excusions for users

How are they going to access it if you take away all the permissions from accessing? I see your quandary. Not sure how you are going to give them permissions to use something that you don't want them to use.

You can deny them local login access to the machine but if they need access to something over the network they have to see it to be able to use it.

Read other 3 answers

DC: Win Server 2003
Laptops: Win7 Pro

When joining a set of laptops to the domain it prompts for domain admin credentials and appears to be successful, but gives an error of 'Changing the Primary Domain DNS name of this computer to " " failed. The name will remain domain.local
The error was:

The RPC Server is unavailable.

When attempting to add Domain Users to the local administrators group:
Windows cannot process the object with the name "domain users" because of the following error:
The RPC server is unavailable.
This happens even when wired on the network. I have tried uncommenting the localhost line in HOSTS, and manually adding the DNS server (which is also the DC).

Any suggestions would be very helpful.

A:RPC error adding domain users to local admin group

Have you checked the RPC service on the server? Manually stop and restart it as well.

Read other 4 answers

I created a policy for non-administrators in Microsoft Management Console. However, I couldn't find a policy to restrict user into a specified folder.

A:How to use local group policy editor to restrict users to Desktop

Exactly what are you trying to accomplish?

Read other 3 answers

my computer management do not shows local user and group snap-in in windows 8.1, how to enable it,sometime before it was enabled in it,but when i again see it,it is not there,plzz tell me how to fix this problem.

A:compmgt console do not show local users and group snap in.

Hello Ketan, and welcome to Eight Forums.

Local Users and Groups is only available in the Pro and Enterprise editions of Windows 8/8.1.

Read other 5 answers

I want to use Local Group Policy Editor to apply group policy to a specific custom security group created using local users
and groups snapin for MMC.
Is this possible and if so how?

If not, than what is the purpose of being to add local security groups.

Custom groups do not appear to show up in the list of users compatible with local group policy. 

Software/Hardware used:
Windows 8

Read other answers

I'm trying to redirect Documents, Music, Pictures, Videos, and Favorites folders to a network drive via GPO with Win7.  This has worked for us without issue in the past using XP.
I am using the Folder Redirection GPO set to Basic, with "grant user exclusive rights to documents" and "move the contents of documents to the new location" set to disabled.  "Also apply redirection policy to Windows 2000..."
is set to enabled.
Whenever a user (that is not a member of local administrators or power users group) logs in, the GPO applies properly and the folders are redirected.
Whenever a user (that is a member of local administrators or power users group) logs in, the folder redirection fails.
Application log shows Event ID 502 and the error reads as follows (for example):
Failed to apply policy and redirect folder "Favorites" to "H:\Favorites".
Redirection options= 0x9000.
The following error occured: "Can not create folder "H:\Favorites"".
Error details: "The system cannot find the path specified".
The same errors are reported for the other attempted redirected folders.
H:\Favorites exists, H: is mapped and accessible.
"Always wait for the network at computer startup and logon" is enabled.
If the user is not a member of "Power Users" or "Administrators," the redirections work properly.
What am I missing?
Thank you!

A:Folder Redirection Fails when user is a member of local administrators or power users group

Hi m.wolfe,
Based on the logs you provided, I considered this could be the connection issue that the Group Policy cannot be applied. I suggest you to configure the EnableLinkedConnections
registry value to check if the issue persists.
Follow these steps:
1. Click Start, type regedit in the Start Search box, and press ENTER.
2. Locate and then right-click the following registry subkey:
3. Point to New, and then click DWORD Value.
4. Type EnableLinkedConnections, and then click Modify.
5. In the Value data box, type 1, and then click OK.
6. Exist Registry Editor, and then restart the computer.
Best Regards,
Miya Yao
TechNet Subscriber Support
in forum. If you have any feedback on our support, please contact
[email protected] posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer
your question. This can be beneficial to other community members reading the thread.

Read other 11 answers

Hi all
For the past 6 months we have received reports of PC's taking up to an hour to get to the login prompt.
All our PC's are running Windows 7 32/64 Bit.
The message is always "Applying Group Policy Local Users and Groups policy"
Once it gets to the login prompt they will login with no problem.
I have enabled GPO logging on 1 PC and the results show as below (sorry for the wall of text) Boot time was 15:16.
I was hoping someone else had come across this issue and maybe has some insight
Network team say "its not the network"!!
Server Team say "Its not DNS or Group Policy" !! 
So its been left with me on the desktop team to diagnose the fault
Paul Griffiths - NHS Trust in Bristol

GPSVC(534.75c) 15:17:14:459 ProcessGPOs: -----------------------
GPSVC(534.75c) 15:17:14:459 ProcessGPOs: Processing extension Group Policy Local Users and Groups
GPSVC(534.75c) 15:17:14:459 ReadStatus: Read Extension's Previous status successfully.
GPSVC(534.75c) 15:17:14:459 CompareGPOLists:  The lists are the same.
GPSVC(534.75c) 15:17:14:459 GPLockPolicySection: Sid = (null), dwTimeout = 30000, dwFlags = 0
GPSVC(534.75c) 15:17:14:459 LockPolicySection called for user <Machine>
GPSVC(534.75c) 15:17:14:459 Sync Lock Called
GPSVC(534.75c) 15:17:14:459 Writer Lock got immediately.
GPSVC(534.75c) 15:17:14:459 Lock taken successfully
GPSVC(534.75c) 15:17:14:459 ProcessGPOList: Entering for extension Group Policy ... Read more

Read other answers


Can somebody help me?

My initial admin account (made with the installation of windows7) is Marie.
When I look at the Local Users and Groups snap-in of MMC, she's member of the group administrators but not of the group Users.

then I made a folder "Test".
I disabled the inheritance.
Then I gave the group Users deny permissions of this folder.
The administrators group I gave full control permissions.

The strange thing is that Marie gets also deny permissions though she's not a member of the local group Users but she's member of the group Administrators.

Can somebody give me an anwser on this problem?

Thanks in advance!!

Kind Regards.

A:Membership of local built-in group "Users" -- NTFS permissions

Please post screenshot of permissions. Please post screenshot of users members list and administrators list as well.

Read other 8 answers

I would like to restrict anyone except Administrators from installing Windows Updates on my Windows 8.1 Pro x64 ENG machine.

In Windows 7 it's easy:
Control Panel / Settings / Windows Updates / change settings:
"Allow all users to install Windows Updates" -- uncheck to disable.

Is there a similar setting in Windows 8.1 via Control Panel GUI, secpol.mmc or regedit? I can't find it.

Thanks, all!

Read other answers

I have a script (Kindly originated by Golden in this thread http://www.sevenforums.com/backup-restore/317082-using-task-scheduler-fails-run-robocopy. )

Script robocopy I:\DATA M:\Backup_DATA /e /np /log:backup_log.txt which is run at shutdown.

In my M:\ drive I have two identically named folders: 'Backup_DATA', one (call it A) containing the correct 70 folders and 1003 files 295mb. Dated 11 January 2014 11:19:41 in properties, right click.
The second copy (Call it B) contains 2 folders 0 files 0 Bytes and is dated the same 11 January 2014 11:19:41 in properties, right click.

Although they are both shown on my M:\ drive as: (A) Backup_DATA dated 10/1/2014 at 16.46 and (B) Backup_DATA dated 9/1/2014 18.36.

I am not able to delete the ghost copy (B) as when I try I receive the following popup:
"Could not find this item.This is no longer located in M:\ verify its location and try again"

Not sure where to go from here, any suggestions? !!


I am unable to delete or rename the folder 'Backup_DATA', however inside the folder is another folder named 'e' and that contains another folder named 'np'. The 'np' folder is empty.
Now it seems quite a coincidence that both 'e' and 'np' make up part of the Robocopy script .

I am still unable to delete these sub folders as each one no longer exists on my M: drive.

A:Robocopy and Group Policy generates 1 real & 1 Ghost file.

Well, folder removed

Tried to do this in dos same problem, although it was shown it did not exist! Searched around and came across Unlocker. Using Unlocker I still could not delete the Backup_DATA folder itself, it remained even after the suggested re-boot. I had to delete the 'np' folder first, then the 'e' folder, and then the 'Backup_DATA' folder.

It seems Unlocker succeeded where anything else I tried failed.

Read other 1 answers

I need to add a domain group containing a large amount of users to a local group on several machines. I can create the group locally, but I would have to manually enter each user account. I just want to add the existing domain group.

It is an NT network and the clients are XP Pro.

A:Adding a domain group into a local group

Nevermind, I figured it out.

Read other 1 answers

After forgetting the local administrator password, I followed that guide for offline editing the SAM registry file. This clearly caused a problem, because no I see no users in LUAG as per the attached. All the accounts work fine, except the built-in administrator account which I can't do anything with (if I try to enable it using the 'net user' command, net crashes).

I suspect I may just have to live with this, but does anyone have any suggestions about how to 'clean' the administrator account in the registry so that LUAG works again?


A:No users visible in Local Users and Groups

Check your Windows version!

If you have the Windows 10 Home edition, then it will not have Local Users and Groups (lusrmgr.msc) included in it. It's only available in the Pro and Enterprise editions instead.

What command(s) you use to activate the Administrator?

Read other 2 answers

I have a stand alone Windows 7 64 bit system. I am one of several local administrators. I do not have access to the default local administrators account. That is locked down by the security team. I need to delete a user account that is a member of the
Administrators account. When I try to delete the account I get an error "The specified account is not a member of the group". When I open the Administrators group it is empty. Being a member of the Administrators group I try to add myself and get
the message that I am already a member of the group. I opened the users account and try to remove the administrators group I get an error. This is an isolated system (no internet access). I cannot download or run any software as it takes a long time to get
approval. This sounds like the Administrators group has a broken SID. Any ideas?

Read other answers

Somehow I added a tile group to my start screen... Problem is it has no tiles in it and I don't want it there. However, I see no way to remove it. I press and hold and all it does is let me name it (it has no name currently) or resize it...
Can someone please tell me how to remove it? It was not on there and somehow lol in my pocket / bag I added it like a goof ball.

Read other answers

Under Windows 2000, when I reformat the computer, I add administrator user as a network user in the install process. Then, I go in and add local users to the computer. Later on when I want to add network users, it won't let me, the computer just hangs. Any ideas?

A:Can't add network users after add local users

Not much information to go on here, but are you signed on as a network admin when you are trying to add the network users?

When you say you add the administrator user as a network user, what are you referring to? Are you adding the Network Administrator account to the local PC?

Read other 3 answers


We upgraded our desktops from Windows XP to Windows 7, with Windows XP we used the resource kitís CDROMLOCK.EXE to lock down CD and DVD. Once installed a user had to be in the local administrators group to access a CD or DVD on that desktop.

For Windows 7 it is not Windows 7 compatible so I run the EXE in Vista SP-2 Compatibility mode, which works perfect.

My question: With a user in the local admin group they have access to the CD and DVD, but also have full access to the desktop, which is of concern. Does anyone know how to assign a user name (Either local Desktop or a Server 2003\2008\2010) domain account to a service or Exe?

Is there a way to either create a folder with full rights and then put the exe in the folder, giving the user full admin rights to the folder, or assign full admin rights to s single EXE file?

I am just not sure how Windows 7 controls local admin rights other than the local Admin Group.

If this is in the wrong group, please move.



A:Assign Local Admin Rights without local Admin Group

You should be able to right-click on the exe file, then choose properties. On the "Compatibility" tab, there should be a checkbox for "Run as administrator", which you can check (enable) and save settings.

Read other 1 answers

The Group policy administrative templates folder is empty it wasn't empty before

A:Group policy administrative templates folder is empty in windows xp

Do you have a Restore Point from ealier or pehaps a backup image?

Read other 5 answers

I have read about this somewhere but I did not exactly pay attention to it.
I found 40 empty folders under Local......

Would some one tell me how do they materialize ? Or, What did I do to cause that ?
I would assume it is ok to delete them. Yes ?

Thank you.
( screenshot of empty folders ).....

A:40 empty folders under Local

Wouldn't happen to have Live Messenger installed would you? If so then that is likely where they came from, with a new one being generated every time you open Messenger. You can actually see it happen if you have that folder open at the same time as you open Messneger, by the time Messenger is finished loading and logging in a new one of those folders will be there.

It's a bug in Messenger from what I can see where it creates that folder there instead of in the Temp folder. They are also safe to delete. Doesn't happen on all systems, but been a few asking about them here as well as elsewhere (I get it on my computer, yet it doesn't happen on my kids computer).

Is this supposed to be there?

Strange empty Folders?

Read other 9 answers

Hi everyone, I really need help on this so I will try to include as much detail so you guys don't get confused at what I'm talking about.

Heres what happened:

1) I was clearing up space on my hard drive and deleting stuff that I don't need.

2) I came across C:\Windows.old\windows folder and saw that it was about 13 gigabytes - and seeing that it's from windows.old, I deleted the windows folder contained there.

3) After deleting C:\Windows.old\windows , I find out that my C:\Windows.old\users folder is empty, how is this possible?

Is there any way to locate my files, I KNOW that they are still there - but there must be some strange bug or something idk, cause all I deleted was the "windows" folder and suddenly my users folder becomes empty. Help is greatly appreciated!

A:Users folder empty?!

Was there anything in it?

you can try this to recover it,

Recuva - Undelete, Unerase, File and Disk Recovery - Free Download

Read other 9 answers

i want to apply a gpo for a group, but when i open mmc > add anap-in > Group policy object > Browse
> users..
i can see only users, "administrators group" and "non administrators group".
i cant find groups ive created locally by myself..

Read other answers

How is this group created? Is it still needed/ required? (is it deprecated) What does it do in regards to active directory?

Read other answers

i want to apply a gpo for a group, but when i open mmc > add anap-in > Group policy object > Browse > users..
i can see only users, "administrators group" and "non administrators group".
i cant find groups ive created locally by myself..

Read other answers

 Reviewing PCs in my work I found the following situation in some Pcs:
 1. The local administrator belonging to group of user debuggers.
 2. The Domain Administrator belonging to group of user debuggers
 3. Sometimes the domain user using the PC belonging to user debuggers.
 I researched the services of machines and all of them have a service called Machine Debug Manager located in C: \ Program Files \ Common Files \ Microsoft Shared \ VS7Debug \ mdm.exe. Machines do not have visual studio, but Office. The questions I have:
 a) When you install Office XP, is this service automatically installed?
  Is the user who installs the service, added to user debuggers or someone have to add it manually or automatically using scripts?
 c) What sense does this group and what is the purpose that of the user? Can it be used for bad ways?
 Best regards and thanks in advance

A:Debugger Users Group

Visual Studio has nothing to do with MS Office.  The data you supplied reflects the Visual Studio debug function.
Microsoft installs the debug function in some of its applications, including VS and Office.  Personally, I have never found this function to be worthy of running and have always disabled when an Office install popped up error messages about it. 

Read other 1 answers

I'm not sure if it is possible but I was wondering if it was possible to change a users permissions so that they could not change their password or other user/computer settings and etc. I have seen mention of other user groups and I see mention of changing group permissions in several help articles but I'm looking for a more defined answer.

All help is welcome and thank you all in advance.

P.S. I think this is in the right spot but if not I apologize.

A:Users/Group Permissions

You can setup a user so their password never expire. In Control Panel / Administrative Tools / Computer Managerment / Local Users and Groups / Users . Right click on the user name and choose Properties. Checkmark "user cannot change password".
( Win 7 method, should be the same in Vista, and almost the same in XP )

In order to stop the user from making system wide changes, change the account to a Standard / Limited User account.

Read other 1 answers

Hello everyone, sorry if this is the wrong place to post this query.

I am seeing a lot of folders with seemingly random names, all of which are empty, appearing in AppData/Local. I check back every few days and there are more and more... Why are these folders appearing and what is their purpose?

Attached is a screenshot of what I'm talking about... if you notice where the scrollbar is, the whole area above is just more empty folders; 87 of them right now.


A:Empty folders in AppData/Local

Hi, welcome to the forums

I have seen similar folders appear on machines infected with malware. Are there any strange files in the same folder? (scroll to the bottom).

You may want to download MalwareBytes and perform a full system scan just to be on the safe side. You will find that those folders can be deleted with no issues to your system.


Read other 9 answers


I changed the location of all folders except Desktop to another partition.
Now, when I click on C:\Users\Username\Desktop, it shows empty.
Is it ok (Desktop is not empty by the way) ?
Should I relocate all the folders to their original location?
Any suggestions about that?

P.S.: Why cannot Windows access a folder in a HFS+ partition even though Users, Username (Administrator), and Administrators has full control and even though Windows can create the folders (It was able to create the folders, but not the files, Owner is the Username (Administrator))?

A:C:\Users\Username\Desktop is Empty.

If you say you moved "All" folders - are you talking about user folders (Documents, Pictures, etc.) or did you move system folders too. And how did you move them - with the Location tab in Properties??

Read other 9 answers

Hi guys,
Iíve a question regarding local admin group management.
Suppose a user is responsible for managing some application installed on a server. The user doesnít normally need to change server configuration like IP address, time settings and so (i.e. privileges).
For Microsoft applications like SharePoint or for servers like IIS I can use the preconfigured groups. But suppose weíre talking about some third party application and I canít know for sure what kind of access the user need.
Maybe the user need to install something and thus require modify permission to some files also the installation may need to change some registry values and configure services.
For example, one of the application owners in my organization needs to connect some constructor to perform some maintenance on a server. Of course I can limit his access but what if he need perform installation of software or change some registry? In any case the application owner will have to find some system administrator to connect him with the needed level of access.
So as we can see I need to find a way to combine permissions and privileges.
My question is what is the correct approach in this situation?

1. Are there any best practices or guide lines for this issue? Iíve searched many forums but wasnít able find some clear approach and best practices.
2. Is it acceptable to give application owner or developers local admin permissions? Maybe itís the way to go and Iím wasting my time here.
3. What is the co... Read more

A:local admin group management

A developer would only have admni rights to a test server in a test network where he can try out his application. Then when the application is ready, he writes the procedures down and hand it over to the IT admin who handle all administration of the application on the live serer.

Read other 1 answers

I have bought a MSI laptop recently with windows 10 installed on it.
In the computer management console Local users and groups snap-in is missing. I have tried the lusrmgr.msc command to

but only a window opened displaying message "The snap in may not be used with this edition of windows.-----" please help on this.

Please help and show it step by step kindly.
Thank you.

Read other answers

A Limited USER has has changed to be an Admin..
i tried to delete that user and creat another
BUT i recieve this mes.
The specified account name is already a member of the local group
i tried to delete the User from ADMIN group but i can't
i attached pic. of the mes. that appears to me

any solution to fix this problem ??

A:The specified account name is already a member of the local group

Do you see the user when you run lusrmgr.msc?

Read other 3 answers

I have a large network of about 500 machines on a domain. I have set up a local account for exams, with a special local Group Policy that is for non-administrators. The group policy restricts almost everything apart from a few applications.

I need to copy this GP over to another 20-30 machines. Is there any way i can do this.

Copying %systemroot%\system32\grouppolicy didn't work.

A:How to copy local Group Policy?

Welcome to Sevenforums theslowminded!

After you copied the policy over, did you force the update?

gpupdate /force

Read other 4 answers

I've an WinXP SP2 box that I locked down using the Local Group Policy MMC but I need to know if I can selectively lock down accounts manner. I'd like to lock down all the accounts save the local admin account. Thanks in advance!

Read other answers

Hello, I'm using window 7 home. So i dont have local group policy. I want to stop user other than "admin" myself to enter control panel. Anyone know to do it manually? I know there is a way to do it manually with regedit at user setting but not sure how. Or is there any software that does the same thing as local group policy of pro--enterprise edition of window 7?

A:Window 7 local group policy


slight cheating way around it i suppose, go to windows secrets control panel custom etc etc etc

Read other 3 answers

Hi, I have a local group policy on Vista x64 that is not running. This script runs fine on every other OS. W2K > Win7 (including x64 machines) It is a machine policy and it will not run. It is a script that runs bginfo from the Program Files folder. Any ideas? Thanks

A:Local Group Policy Not Running


What version of Vista is this? Is it Home Premium, Home Basic, Business Basic, Business Premium or Ultimate (or other)?

Go into Services, and check for the "Group Policy Client" service. You cannot (easily) stop this service, but make sure it is there and running.


Read other 8 answers

do u know how to configure group policy so once user logs in,he can be assigned local administrator rights.

I wants the moment user logs in a new computer in a domain,in their user configuration
they will automatically assigned local administrator rights rather than I am using contol panel to add manually.

Read other answers

I have created three user accounts on my computer. Admin, Maint and operator...added the operator account to the group policy snap-in with very restricted policies. Problem is I have somehow associated the Admin and maint as well, how do I reset the local group policy back to default settings? I need to recover the admin capabilities to make changes to the computers.

A:local group policy editor

Hi..JOEYGE... Welcome to SF...Check this link. Hope it helps.

Local Group Policy - Reset to Default

Read other 9 answers

I try to add a domain User to local administrator group
We are a intertanional Company (Austria French Sweeden)
The commandline is: net localgroup s-1-5-32-544 domain\user /add
i recive the error
System Error 1376 has occurred
The specified local group does not exist
Please helpe

A:Add Domain User to Local Group with SID

"Net localgroup" allows adding a domain local group from a trusted domain. The membership is there but will never work as the SID will not appear in the access token
of a user or computer connecting to the machine. the security identifier (SID) of the domain controller is not identified in the operation. For more reference, please see:
Domain local group from foreign domain can be added using "net localgroup" and GC search
Best Regards

Read other 7 answers

Hello I am new and I'm trying to secure my computer.

I have been using my Computer and going online as an administrator since I've had the computer-less than 2 years. I read an article advising people not to do this, but create another account on the computer and use that to go online. I created a new account, but how do I join the Users or Powers Users Group?

My computer is a Dell and uses Windows XP Service Pack 3. Thanks in advance....

Rhyddid Rose R

A:Adding Self to Power Users Group

Go to start, run, then type
control userpasswords2
That has more options. Alternately you could use

Read other 1 answers


I want to give the ability to the user group to turn off instantly aero (using either the right click or normal shortcuts described in the tutorials) without revealing my administrator pass to them (or have to be there to type it).

This also is a solution for x64 apps (That have grayed out these options in compability tab, it is a win 7 bug) in occasion of my network with no expert users.... (If there is a solution, I will combine an x64 app with an turn off aero in a single shortcut )

Sorry if this has been replied before... any answers will be apreciated

A:How to allow users group to turn off Aero

I don't think you necessarily understand administration - either you manage the machines for the users (turning off things they don't want/use, changing application compatibility settings, etc, or you give them administrative privileges for managing their machine. Understanding how these things works might better help you understand why admin privs are required - to disable aero, you must be able to stop a service, unload a driver, stop a kernel-mode process, and then restart the video subsystem. None of these things would you ever want a non-administrator to be able to do in a managed setting. To set compatibility options for a process, you have to be able to write to a non-user-controlled portion of the registry, as well as add app-compat data to a protected location on the system (in this case, the Windows directory). Again, in a usual case, not something you'd give non-admins rights to do.

Hence, these things require admin privileges, so either you manage the machines, or they do - but someone's got to . To get to the point though, the first real question to ask is, *why* do users need to do these things?

Read other 4 answers