Brugerrettigheder på NT4

you can make users local administrators if it\'s not agains your policy. (not domain admin)

I would rather like to avoid that if it is possible!! But I will test what you have suggested!

Lokal admin

there is also a lot to achieve through system policies. It depends on your infrastructure. If you logged on to an NT domain then start poledit and browse your way until you find the right settings. or start user manager for domains (start run usrmgr) under \"user rights\" and \"show advanced\" you have an option to allow users to change system time.

if you are a part of win2k domain (active directory) then you have GPO\'s (group policies objects) you can edit under \"administrative tools\"

After finding the right settings in poledit what do I then do to \"apply\" them to the user?

I should perhaps add that I\'m using roaming profiles on my NT4 server and that the clients are NT4 workstations

save it the \"netlogon\" share on the PDC (it\'s not the folder name but the share name)
save it with the name ntconfig.pol

when computers logon to the domain they look for a ntconfig.pol by default.

How do I secure that it will only applies for this one that it should be applied for?? And the rest of the users who log in are unaffected!

don\'t use the default computer or default user icons. creat a new one

Create a new one with the name of the user and then save it to D:\\WINNT\\system32\\Repl\\Import\\Scripts??

true! IF I remember correctly (long time no NT) then you can even browse to find the user from your domain users list

Thanks! I will go and test!

Ok! I now have control over the system policies! Thanks! There is a checkbox \"Disable registry editing tools\". If I leave this blank I can start regedit.exe but I still can\'t create keys!

Where does Microsoft hide the user rights assigned to the user groups? Say fx \"Domain Admins\"??

Are these groups \"build-in\" and not changeable or viewable?

Its really strange! I enter User Manager For Domains.. I add the user under \"User can change system watch\"! Save and exit!

I then log into the domain with the user and try to change the time and get a \"A required privilege is not held by the client\".. But.. I just added the right!! How can that be?

try restarting the workstation.
also, if your workstation authenticates against a BDC then you need to make sure that your PDC and BDC replicate.

We only have a PDC! I restarted the workstation and that didn\'t help!

Damn! Stupid that such a fairly simple thing should be so hard!!

yes. it is much easier in a win2k environment.
try to see that there no permission conflicts.

for example if you allow a user to change system time but on the same time the everyone group has \"no access\" then this explains your problem.

if that is the case then remove the everyone group rather then allowing it to change system time.

The user is a member of a group called \"test\" .. \"test\" has the right to change the system clock and so does the user! But still no right to change the time!!

try removing the \"everyone\" group or any other global groups you think might have a conflict with the test group.

and to try something totally else... did you try to add that specific user to the build in power groups? for example \"server operator\" or something like that.

again, sorry for the \"guessing in terms\", it has been a while since NT for me. and I don\'t have an NT box to test on.

to make things even more complicated see this:
http://www.jsiinc.com/suba/tip0200/rh0252.htm

That seems to be a command line version of what I\'m doing in UserManager! It will proberly render the same results!

I tried giving my user \"Server operator\" rights but with the same result!! No access! Damn!

TAK FORDI I SKIVER PÅ DANSK :-(

Har du svært ved at forstå engelsk Megabad??