pkirtley

HOW TO: Restrict Group Membership By Using Group Policy in Windows 2000 The information in this article applies to: Microsoft Windows 2000 Server Microsoft Windows 2000 Advanced Server This article was previously published under Q320045 IN THIS TASK SUMMARY Create a Group Policy Object Configure Group Membership Troubleshooting REFERENCES SUMMARY This step-by-step article describes how to restrict group membership by using group policy. In some cases, you may want to restrict the membership of certain groups in a Windows 2000 domain to prevent the addition of other user accounts to those groups. back to the top Create a Group Policy Object To create a Group Policy Object (GPO) with which to restrict group membership: Start the Active Directory Users and Computers snap-in. To do so, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers. In the console tree, right-click your domain or the organizational unit in which you want to create the group policy, and then click Properties. Click the Group Policy tab, and then click New. Type the name that you want to call this policy (for example, Account restriction policy), and then press ENTER. Click Close. back to the top Configure Group Membership Start the Active Directory Users and Computers snap-in. In the console tree, right-click your domain or the organizational unit that contains the group policy that you want, and then click Properties. Click the Group Policy tab, select the group policy object that you want, and then click Edit. Expand Computer Configuration, expand Windows Settings, and then expand Security Settings. Right-click Restricted Groups, and then click Add Group. Click Browse, click the group that you want to add, (for example, click Backup Operators), and then click Add. When you are finished adding groups, click OK. In the Add Group dialog box, click OK. The groups to which you want to restrict access are displayed in the right pane of the Group Policy snap-in. Double-click a group in the right pane of the Group Policy snap-in. For example, double-click Backup Operators. To restrict the membership of this group: Click the Add button that corresponds to the Members of this group box. Click Browse, click the user or group account that you want to add to the group, and then click Add. When you are finished adding users or groups, click OK. In the Add Member dialog box, click OK. To restrict the groups to which this group can be a member: Click the Add button that corresponds to the This group is a member of box. Click Browse, click the group account to which you want to add this group, and then click Add. When you are finished adding groups, click OK. In the Group Membership dialog box, click OK. In the Configure Membership for Group_name dialog box, click OK. Quit the Group Policy snap-in, and then click OK. back to the top Troubleshooting When you restrict group membership by using group policy, you may notice that you can still add users to a group to which they have been denied access. Changes to restricted groups remain in effect until group policy is refreshed. When group policy is refreshed, restricted group memberships are reapplied, removing any changes that are made to the membership of the restricted group. For additional information about how to refresh group policy, click the article number below to view the article in the Microsoft Knowledge Base: 227302 Using SECEDIT to Force a Group Policy Refresh Immediately The default membership of a restricted group is no members. By leaving the group with the default membership of no members, you can provide additional security to groups to which you want to prevent membership. For example, you can use this method to ensure that no user accounts are members of the Guests group. back to the top REFERENCES For additional information, click the article number below to view the article in the Microsoft Knowledge Base: 259576 Group Policy Application Rules for Domain Controllers For more information about Group Policy, see the "Introduction to Windows 2000 Group Policy" white paper at the following Microsoft Web site: http://www.microsoft.com/windows2000/techinfo/howitworks/management/grouppolicyintro.asp Or go here http://support.microsoft.com/default.aspx?scid=KB;en-us;320045& Hope It Helps

Service Pack 3

are you adding the administrator to the group policy aswell? Because If you ad the admin to the same policy if its windows 2000 (not to sure about other O/S) it will set the rights to the lower policy

You will find wilth windows Xp that it has a firewall built it check this isnt enabled as it dose stop file transfers in messanger to check if its enabled Goto start, settings, control panel Network connections right click the one you want then properties then click on the advanced tab and check the box is NOT ticked that says internet connection firewall also check the lan connection one aswell Regards

Might seem stupid but i had a similar problem with an NT4 Server turn out the procesor fan was on its way out and the cpu was getting to hot and the server was shut down by the motherboard protecting its self

OK here the story i have been away on holiday and some fool let the bosses son have access to the domain controler (Windows 2000 Avanced Server), It Turn out the bosses son thought he would help me out and (dare i say it) run clean sweep on the Domain Controler (PS just want to state i DID NOT Give Hime the administrator password or rights). Now The problem i have is msdtc.exe is taking up 98% of the system Resorces and i cant Think of anything else to try Anyone got any suggestions Thanx For Ya Help In Advance