Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have Active Directory 2003 and my users are on Windows XP. How can I set a policy to active network configuration for the users? In other words some users are traveling a lot so I want to give them allow to change network configuration.

share|improve this question

You can manage the network configuration on a system without having local Administrator rights if you are a member of the "Network Configuration Operators" local group; so you will need to add your domain users to this local group on the machines where they need this specific right.

Whatever is better to do this via group policy or manually depends on if you want those users to have this right on every computer or only on their own one.

share|improve this answer
Ok is there a way to add some users to network configuration operators from active directory to avoid go to each PC for example user1 and user2 when they are logon immediately they are inside network configuration operators? – Codey Jun 8 '11 at 7:48
Yes, you can use the "resticted groups" settings in a group policy. – Massimo Jun 8 '11 at 8:27
There are two options, Group Policy Restricted Groups and Group Policy Preferences (the last word makes a world of difference) local group settings. The former is exclusive: if you have anyone in a group that is not specified in the policy, they will get removed every policy refresh, reboot, whatever makes sense first logically. The latter is inclusive and will only add, remove, modify those people specified by policy. – songei2f Jun 8 '11 at 12:37
@alharaka: the second option is only available from Windows Server 2008, the question is about 2003. – Massimo Jun 8 '11 at 13:06
@Massimo: Untrue. You can install the Client Side Extensions if you need them on XP and Vista. Domain is not an issue, but the GP Management console version and the admin workstation is. I have done this because the flexibility required in large domain environments where I was in charge of a few OU's, and other domain admins were uncooperative. – songei2f Jun 8 '11 at 15:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.