Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have Active Directory 2003 and my users are on Windows XP. How can I set a policy to active network configuration for the users? In other words some users are traveling a lot so I want to give them allow to change network configuration.

share|improve this question
add comment

1 Answer

You can manage the network configuration on a system without having local Administrator rights if you are a member of the "Network Configuration Operators" local group; so you will need to add your domain users to this local group on the machines where they need this specific right.

Whatever is better to do this via group policy or manually depends on if you want those users to have this right on every computer or only on their own one.

share|improve this answer
    
Ok is there a way to add some users to network configuration operators from active directory to avoid go to each PC for example user1 and user2 when they are logon immediately they are inside network configuration operators? –  Codey Jun 8 '11 at 7:48
2  
Yes, you can use the "resticted groups" settings in a group policy. –  Massimo Jun 8 '11 at 8:27
    
There are two options, Group Policy Restricted Groups and Group Policy Preferences (the last word makes a world of difference) local group settings. The former is exclusive: if you have anyone in a group that is not specified in the policy, they will get removed every policy refresh, reboot, whatever makes sense first logically. The latter is inclusive and will only add, remove, modify those people specified by policy. –  ajstein Jun 8 '11 at 12:37
    
@alharaka: the second option is only available from Windows Server 2008, the question is about 2003. –  Massimo Jun 8 '11 at 13:06
    
@Massimo: Untrue. You can install the Client Side Extensions if you need them on XP and Vista. Domain is not an issue, but the GP Management console version and the admin workstation is. I have done this because the flexibility required in large domain environments where I was in charge of a few OU's, and other domain admins were uncooperative. –  ajstein Jun 8 '11 at 15:52
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.