Q: Adding domain users to local group?

[fLy 0]

Hi, I have a problem on a customer's computer, yeah, you

guessed right XPpro is installed...

Its part of a win2000 domain and its main use is a manging software that resides on the server and accessed with a client installed on it.

You login to the domain with the username of the computer owner successfuly but on the managing software login it fails.

You login to the domain as administrator and login to the software with the same username as before ... it works.

 

Well, the first thing you think is that its probably a permission problem but even after adding the same user to the domain administrators group it didn't work.

 

The managing software support says its definately a permissions problem...The thing is that this guy worked in the same spot with the same login to both the domain and the managing software before, just with win98 installed...

 

The only thing I thought of but haven't succeded in trying is the subject.

 

Does anyone know the solution to the problem, or the subject?

 

Thanks.

[clutch 1]

Honestly, I can't follow your question particularly well. You state that you want to add a particular user to the local admin group of the system? Or are you asking if the domain users group is added to the workstation's local users group? By default, any system attached to a domain will add the domain users group to its local users group, and the domain admins group to its local admins group.

 

As for this "software managing" thing, is this a domain group? I am not sure what you mean by it being on the server, so please clarify. And with the person using Win98, if you could get onto the workstation (assuming no policies were setup to block non-authenticating users from getting on the system) then you can install software. Win98 didn't have any decent methods of prohibiting this, whereas NT does.

[fLy 0]

Ok, clutch where do I start...

I want to add a domain user to the local winxp administrators group.

Adding the same user to the domain admins group havn't solved the problem.

The software I'm talking about is a database accessed by the client for that matter.

The same guy who has the problem with the xp used to work until a week ago on a win98 station which worked PERFECTLY with the same login to the domain and the same login to the specific software.

I'm talking about a domain with a single windows 2000 server with no policies whatsoever.

 

Returning to the q...

[clutch 1]

OK, so are you asking "how" to do it, or have you done it and you are asking why it isn't working? What is the problem that you are seeing? Is the software not installing, or just not working? Sometimes, with some software (especially DB software using ODBC connections) you have to upgrade the person to an admin (either local or domain, doesn't matter as it's temporary) and then install the software under THAT person's logon. That way, all the keys that it makes under HKey Current User will pertain to him/her. Then, when you remove the user from the admin group and have him log back in again, he will be able to use the software as all the keys are linked to him. One other issue that can happen is that the person will ALWAYS need admin permissions to certain keys because the programmer didn't pay attention to (or bother to learn) how software interacts under NT-based permissions. I had this same problem with a fixed asset software package, and had to give the user r/w permissions to a few ODBC keys in order for the software to work properly.

[clutch 1]

Generally, you are better off trying to add the user through the GUI browse button in the user manager. This way, you KNOW that your system is aware of the domain and finding the right SAM to request account info from. So, the idea would be to get this:

 

 

to show up and list all the domains that the workstation can see as available. In this case, the WXP-1 workstation can see itself and the driventechnologies.com AD domain as being valid sources to get account information from. By using the GUI, you are positive that you have a good connection to the domain contollers and can browse out to them if needed.

[fLy 0]

I tried to add the user the way its shown above but the thing is I can only see the local computer, not the entire domain.

This has been tried with 3 different domains...

I haven't thought of a script I have to say...

 

 

Thanks!

[clutch 1]

So, it sounds like the workstation isn't part of the domain to begin with. Are you positive it's a member? It will have to join the domain, so that there is a trust established between the workstation and the domain that has the user account in question. Scripting won't make any difference, as you will be trying to force something that will not work. Can you access any share on the domain controllers that require authentication (like admin or user shares)? Can you ping by name from that workstation?

[fLy 0]

The computer is joined to the domain.

[clutch 1]

The part where you stated you tried with 3 different domains threw me. So, what about my other questions? Can you see shares and ping by NetBIOS name from the troublesome workstation? Have you tried other workstations to see if you can or cannot add the user to their respective admin groups?

[fLy 0]

Apart from the problem stated, there is no other netwotking problem whatsoever, it pings everything it sees everyone and all the other computers see him and ping him.

 

The shitty thing is that the customer having this problem has only one NT client and thats the XP station I'm talking about.

 

As I said, I tried to do it in 3 different networks but only on winxp clients.

[fLy 0]

THANKS!

 

Everyone for the help!

[fLy 0]

Has anyone here ever succeeded in doing the subject, adding a domain user to a local WindowsXP group?

[fLy 0]

Thanks.

 

ps.

I'm damn sure its joined to the domain and logs on to it.

[fLy 0]

About the * question, its given by dhcp.

 

I'll check everything out tommorow.

 

Thanks.

[clutch 1]

Quote:

Has anyone here ever succeeded in doing the subject, adding a domain user to a local WindowsXP group?

I do this regularly for Laptop Users, and it works in both WinNT and Win2K (AD) domains perfectly fine. Also, Win2k/XP will NOT notify you if it can't find a domain controller (unlike NT4) so you might still think you are logging onto your domain, when in fact you are not. Now, can you or can you not access the hidden admin shares on your server from that workstation?