[Ray]

Can someone advise me the differences in access right for installed software
between computer user & domain user in a Windows XP Pro computer.

Thanks,

Ray

[Ron Lowe]

"Ray" <NoSpam-ray.ck.li@Gmail.com> wrote in message
news:efJDsm1cFHA.2644@TK2MSFTNGP09.phx.gbl...
> Can someone advise me the differences in access right for installed
> software between computer user & domain user in a Windows XP Pro computer.
>
> Thanks,
>
> Ray
>


When a computer joins a domain, the domain user's group
'Domain\users' is inserted into the local PC users group, 'LocalPC\Users'.

So in general, a domain user has the same rights as a local user.

This means that anything which has permissions for the 'users' group
will automatically have permissions for domain users too.

However, if something has specific permissions for an individual local user,
like LocalPC\Ron, then that will not include Domain\Ron. These are
different accounts.

This is one reason it's best to grant permissions to groups wherever
possible, rather than individuals.

--
Best Regards
Ron Lowe
MVP - Windows Networking

[Richard G. Harper]

It would rather depend on a number of items - including the exact software
and how it was installed (some software can be installed on a per-user basis
and other users cannot access it), what the rights of the local user versus
the domain user are (either user could either have elevated rights that
would allow access where it would normally not be possible, or either user
could have decreased rights that prohibit access where it would be otherwise
allowed), and so on ...

--
Richard G. Harper [MVP Shell/User] rgharper@gmail.com
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


"Ray" <NoSpam-ray.ck.li@Gmail.com> wrote in message
news:efJDsm1cFHA.2644@TK2MSFTNGP09.phx.gbl...
> Can someone advise me the differences in access right for installed
> software between computer user & domain user in a Windows XP Pro computer.
>
> Thanks,
>
> Ray
>

[Ray]

Ron,

Thanks for your useful information.

I normally configure two accounts for each workstation. One is local pc
administrator account in administrators group and one is domain user account
in power user group. The user is logged on domain at work they are working
on travelling. Under this setup, the user is prohibited to install major
software on their computer without permission of administrator. It works
for most of users. However, I notice a couple of users that they are unable
to write anything on drive C: or access to other accounts on the network
without apparent reasons. If I change the Power User account to
Administrators group, it works fine. I am at loss why most of users are
working correctly with Power User group but some needs administrators group
to work correctly. Any ideas to trace the causes of the problem?

Thanks,

Ray

"Ron Lowe" <ron-msng@{d.e.l.e.t.e}lowe-family.me.uk> wrote in message
news:%23eJ$oS2cFHA.796@TK2MSFTNGP09.phx.gbl...
> "Ray" <NoSpam-ray.ck.li@Gmail.com> wrote in message
> news:efJDsm1cFHA.2644@TK2MSFTNGP09.phx.gbl...
>> Can someone advise me the differences in access right for installed
>> software between computer user & domain user in a Windows XP Pro
>> computer.
>>
>> Thanks,
>>
>> Ray
>>
>
>
> When a computer joins a domain, the domain user's group
> 'Domain\users' is inserted into the local PC users group, 'LocalPC\Users'.
>
> So in general, a domain user has the same rights as a local user.
>
> This means that anything which has permissions for the 'users' group
> will automatically have permissions for domain users too.
>
> However, if something has specific permissions for an individual local
> user, like LocalPC\Ron, then that will not include Domain\Ron. These are
> different accounts.
>
> This is one reason it's best to grant permissions to groups wherever
> possible, rather than individuals.
>
> --
> Best Regards
> Ron Lowe
> MVP - Windows Networking
>
>

[Ray]

Richard,

I notice while installing some software that there is an option to choose if
use in one user or all users. If the software does not have this option
during software installation, how do I know I install the software
correctly?

Thanks,

Ray

"Richard G. Harper" <rgharper@email.com> wrote in message
news:OJgaBE4cFHA.2076@TK2MSFTNGP15.phx.gbl...
> It would rather depend on a number of items - including the exact software
> and how it was installed (some software can be installed on a per-user
> basis and other users cannot access it), what the rights of the local user
> versus the domain user are (either user could either have elevated rights
> that would allow access where it would normally not be possible, or either
> user could have decreased rights that prohibit access where it would be
> otherwise allowed), and so on ...
>
> --
> Richard G. Harper [MVP Shell/User] rgharper@gmail.com
> * PLEASE post all messages and replies in the newsgroups
> * for the benefit of all. Private mail is usually not replied to.
> * My website, such as it is ... http://rgharper.mvps.org/
> * HELP us help YOU ... http://www.dts-l.org/goodpost.htm
>
>
> "Ray" <NoSpam-ray.ck.li@Gmail.com> wrote in message
> news:efJDsm1cFHA.2644@TK2MSFTNGP09.phx.gbl...
>> Can someone advise me the differences in access right for installed
>> software between computer user & domain user in a Windows XP Pro
>> computer.
>>
>> Thanks,
>>
>> Ray
>>
>
>

[Ron Lowe]

"Ray" <NoSpam-lizhiqiang1@GMail.com> wrote in message
news:%23qrEfE6cFHA.1288@tk2msftngp13.phx.gbl...
> Ron,
>
> Thanks for your useful information.
>
> I normally configure two accounts for each workstation. One is local pc
> administrator account in administrators group and one is domain user
> account in power user group. The user is logged on domain at work they
> are working on travelling. Under this setup, the user is prohibited to
> install major software on their computer without permission of
> administrator. It works for most of users. However, I notice a couple of
> users that they are unable to write anything on drive C: or access to
> other accounts on the network without apparent reasons. If I change the
> Power User account to Administrators group, it works fine. I am at loss
> why most of users are working correctly with Power User group but some
> needs administrators group to work correctly. Any ideas to trace the
> causes of the problem?
>
> Thanks,
>
> Ray



You'd need to compare the NTFS permissions on the C: drive
between a machine that works and a machine that doesn't.

On my XP-Pro machine here, the permissions on the C:\ root directory are as
follows:

Administrators group has Full Control;
System has Full Control;
Creator-Owner has Special permissions;
Everyone has Special Permissions( Read+Execute )
Users has Read+Execute

There is no entry for power-users, unless you create one.
So the default permissions will only permit a power user read+execute
permissions,
unless he also happens to be an Administrator.

So I'm not surprised your 'power users' can't write to C:\

The question becomes:
How can your other Power Users write to C:\ ?

Are there additional permissions on the C: root folder,
or is the user a member of an additional group?

It has to be one or the other!

--
Best Regards
Ron Lowe
MVP - Windows Networking

[Richard G. Harper]

By checking the documentation that came with the software. Unless noted
otherwise it will likely load for all users.

--
Richard G. Harper [MVP Shell/User] rgharper@gmail.com
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


"Ray" <NoSpam-lizhiqiang1@GMail.com> wrote in message
news:u9j7fG6cFHA.1412@TK2MSFTNGP10.phx.gbl...
> Richard,
>
> I notice while installing some software that there is an option to choose
> if use in one user or all users. If the software does not have this
> option during software installation, how do I know I install the software
> correctly?
>
> Thanks,
>
> Ray
>
> "Richard G. Harper" <rgharper@email.com> wrote in message
> news:OJgaBE4cFHA.2076@TK2MSFTNGP15.phx.gbl...
>> It would rather depend on a number of items - including the exact
>> software and how it was installed (some software can be installed on a
>> per-user basis and other users cannot access it), what the rights of the
>> local user versus the domain user are (either user could either have
>> elevated rights that would allow access where it would normally not be
>> possible, or either user could have decreased rights that prohibit access
>> where it would be otherwise allowed), and so on ...
>>
>> --
>> Richard G. Harper [MVP Shell/User] rgharper@gmail.com
>> * PLEASE post all messages and replies in the newsgroups
>> * for the benefit of all. Private mail is usually not replied to.
>> * My website, such as it is ... http://rgharper.mvps.org/
>> * HELP us help YOU ... http://www.dts-l.org/goodpost.htm
>>
>>
>> "Ray" <NoSpam-ray.ck.li@Gmail.com> wrote in message
>> news:efJDsm1cFHA.2644@TK2MSFTNGP09.phx.gbl...
>>> Can someone advise me the differences in access right for installed
>>> software between computer user & domain user in a Windows XP Pro
>>> computer.
>>>
>>> Thanks,
>>>
>>> Ray
>>>
>>
>>
>
>