Windows 2000 Administration in a Nutshell

Name

rights

Synopsis

Assign or withhold a system right to a user or group.

Procedures

Assigning rights to users and groups is more complex in Windows 2000 than in the earlier Windows NT operating system because of Group Policy. System rights are configured using the following node in the Group Policy console tree:

Policy root node → Computer Configuration → Windows Settings → Local Policies → User Rights Assignment

Here the policy root node could be:

• The Local Computer Policy

• The Default Domain Policy

• Any custom GPO created for a site, domain, or OU

You can configure user rights settings at any of these policy levels, but the effect will depend upon the result of combining together the Local Security Policy settings and those of the various Group Policies that are applied to the computer. Specifically:

• To assign rights to users or groups on a standalone Windows 2000 Server computer or a Windows 2000 Professional client computer that is part of a workgroup, you configure the User Rights Assignment settings of the Local Security Policy on the computer.

• To assign rights to users or groups on a domain controller, member server, or client computer belonging to a domain, you can assign rights both at the Local Security Policy level and at the level of any Group Policy Objects configured for the site, domain, OU. The effective rights assigned to a user or group are determined by the following order in which policy settings are applied in a domain:

  1. Local Security Policy

  2. Group Policy for sites

  3. Group Policy ...