Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

If I create a new AD domain user account. Does it, by default, have access to locally log on to any machine in the domain and read/write to its hard drive?

What are the default permissions for a new domain user in AD?

share|improve this question

2 Answers

up vote 4 down vote

By default all new users are part of the Domain Users group. That group in turn is part of the Users group on all machines in the domain. So a user will have the privileges of a normal - non admin user on any box in the domain. What that means is they will be able to write to files in their home directory but not much else without permission updates.

share|improve this answer
up vote 3 down vote

A standard user does have the user right to log on locally to all member computers. A standard user does not have the user right to log on locally to a domain controller.

A quick look at the NTFS permissions on the root drive of any member computer will show you what NTFS permissions a standard user has to the file system.

share|improve this answer
+1. Also worth mentioning that this is assuming that the default group policy doesn't alter Restricted Groups and the Allow logon locally/via terminal services settings. – Andy Smith Dec 1 '11 at 0:10
Right, my answer is relevant only to the default settings "out of the box". Thanks for the assist. – joeqwerty Dec 1 '11 at 0:13
Of course - reason I mention it is because this one has bit me on the backside before ;-D – Andy Smith Dec 1 '11 at 0:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.