Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hello I am in a little factory and it is my first time there, they had a windows server 2003 and i wonder how they have set up the users in a unusual way.

The users can install any program and i don't understand how someone before of me did this.

This user (not administrator) is memebr of "users domain" that's it.

I did try to configure a new user same that but my new user cannot install any program, it require a administrator user to do that.

So, i can't understand, how is possible? In the AD server apparently the two users are the same, but, the first user can install everything the second not.

My question is: Someone can help me to find out HOW they set up the second user? Some one please can make me a list as a "step by step" to check?

Thanx in advance

----- UPDATE AUGUST 27 2010 -----

sorry for this later response, and also, i'm at home right now and i cannot check, but, i'll tray again to explain.

In Server 2003 AD DC: user is created as default, and it is not member of admin users.

In workstation: once has made a logon, user has privileges to install everything on THIS workstation, seems that has admin rights, but in server 2003 it is a normal user.

In this workstation, as client of a AD DC, there exist only the administrator user.

as jscott write, maybe point to a right direction.

maybe, if i do as follow:

1) on workstation change domain to a workgroup (example: domain is workgroup will be: mydomain)

2) on workstation log in as administrator 3) on workstation then i can check if exists a "domain users" group member of "administrator group" if this could be yes, that every AD normal users that use THAT single PC, will have administrator rights.

What i wrote has any sense? Could be work? I think that workstations that act in this way, could be have them this king of config.

I cannot check right now, someone can do this check on his/network?

I think that the right question will be:

Give Local Administration Rights to User Domain

Ho can i do it?

share|improve this question
Are you sure the users aren't members of the Local Admin group on the server? – Chris S Aug 23 '10 at 17:42
Thank you Chris. Well, on MEMBER tag there is just User Domain Any other idea? – xer Aug 23 '10 at 17:46
Is the group "Domain Users" a member of the local Administrators group? – jscott Aug 23 '10 at 17:47
can you be more specific? On the server in question, if you open local Users and Groups, in the Administrators group, are there more members than just "Domain Admins" (and possibly a local Administrator account)? – Chris S Aug 23 '10 at 17:53
Are you saying they cannot install an application on their PC or the server? If the answer is their PC, then in the answers below, when they ask if the group is a member of Local Admins, they are asking about the client PC... – BillN Aug 23 '10 at 23:25

I am assuming that the server in question is not a domain controller.

Log onto the server in question as a domain administrator.
Click on Start, Right click on My Computer and choose manage.
Expand "Local Users and Groups"
Click Groups
On the right hand side, double click administrators.

EDIT: Yes it is a DC...
Log onto the server in question as a domain administrator.
Open Active Directory Users and Computers.
In the domain there should be an OU called "builtin".
In that OU there should be a group called Administrators.
Double click that group and check the members of it.

I'm sorry I can't be quite as step by step with this, my DC is server 2008 and I can't remember how similar they are.

Any one in this administrators group will have permission to install programs.

share|improve this answer
pip Yes, it is a Domain Controller so, there is not "local user and groups" from manage tool. – xer Aug 23 '10 at 18:02
Answer updated to show how to check the equivelent of local admin on a DC. – pipTheGeek Aug 23 '10 at 19:23
question updated – xer Aug 27 '10 at 18:00

Are you sure that the application was actually installed (i.e. it is in the Add/Remove Programs), and not just a standalone or portable binary application?


share|improve this answer
up vote 0 down vote accepted

Well... I have figured out.

I was too quick to install at home a windows2003 server and a windows xp on VirtualPC to make some tests.

On a workstations of AD. Log on as administrator, start->user controlpassword2

on local group, in administrators group, simply ADD:

DOMAIN\user name

or if we want just ALL Domain Users add:

DOMAIN\ Domain Users

Log off ad re login as user....

Sorry if my first question was badly explained Regards and thank you for your help

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.