Welcome to the next free video for the free Active Directory course. In this video I will
look at default local groups. Default local groups are groups that are created on the
local computer in order to make administration easier. If you want to give a user access
to perform certain tasks, you simply need to add the user to that group.
Shown here are the 14 default local groups that exist in Windows Server 2008 and Windows
7. These groups exist in the local computer database and thus are only available on that
computer. In this video, I will go though each of these groups. At the end of the video
I will go through how to use these local groups using Windows 7. If you are only interested
in a particular group you can click the link here or in the description to jump to this
group. On your computer you may have additional groups
that are not listed here. When you install additional services and software, additional
local groups may be created for these services and software. Since local groups are local
to that computer only, to provide centralized administration an administrator will often
put a domain group into these local groups. When you add a computer to a domain, certain
domain groups are put into these certain local groups automatically to provide access for
domain users and domain administrators to the computer.
The first group that I will look at is the administrators group. Any user put into the
administrators group will have full control over the computer. An administrator can assign
user rights and access control permissions as required. They have access to everything
and if they have been denied access, they can take ownership and give themselves access.
Unless you have a good reason to do so, the average user should not be given administrator
access. In most cases, the access a user requires can be achieved by adding the user to other
groups on the system. The next group is the users group. The users
group is designed for the average user. When you create a new local user they are automatically
put into this group. This group allows the user to run software and change settings relating
to them. Some system setting they will be able to change while others will require additional
access. When you open the control panel you will see a shield icon next to certain tasks.
These tasks require administrator access. Microsoft has done a lot of work to try and
give the user group all the rights and permissions that the average user would need without giving
them too much power. What a user can and can’t do changes from
operating system to operating system. On a windows 7 computer you want a general user
to be able to reboot their computer. On a Windows Server a general user does not have
the right to reboot the server. Having said that, a general user does not have the right
to login to a Windows Server by default. If the users group does not give the user
enough access, consider adding them to another group. Try not to just add them to the administrators
group if you don’t need to.
The next default local group is the power users group. This was present in Windows XP
to allow legacy software to run. In Windows Vista it was removed. In Windows 7 it has
returned. The power users group is there for legacy reasons. If you can avoid using it,
you should. In Windows 7 the power users group has the
same access as a regular user. Microsoft provides a security template that can be applied to
the system to give the power users group the same rights and permissions that were present
in previous versions of Windows. In Windows XP, the power users group was often
used to give the user more access to the file system and the registry. This may have been
required in order to get poorly written software to run. When running old software I have found
that in a lot of cases you can simply change the NTFS permissions for some of the files
in the program files directory and this allows the software to run. Before jumping in and
adding the user to the power users group, consider making some small changes to the
system to see if this fixes the problem. Also remember that Windows 7 has a lot of compatibility
settings that may help run your legacy software correctly.
The next group that I want to look at is the guests group. Users in the guests group have
very limited access. This group is designed to be used in situations like kiosks.
Kiosks are basically computers that are used in public areas for information or internet
use. A guest profile contains all the user settings like a general user but these changes
are lost when the user logs off. For example, a user logged in as a guest could change the
desktop wallpaper or any other setting they have access to. When they log off, all the
changes they made will be lost. This ensures that when the next user logs in using the
guest account, the computer has the original settings, not the settings that have been
changed by another user. The next default group is the backup operators
group. Users in this group can backup and restore files regardless of the permissions
set on the file. Members of this group can effectively access every file on the system
for the purpose of backing or restoring but they cannot change permissions on files.
The next group is the remote desktop users group. Any users that are members of this
group will be able to access the computer using remote desktop assuming that it is enabled
on the computer. Administrators by default have the ability to access the computer from
remote using remote desktop and thus do not need to be added to this group. Just remember
that even the administrator can not access the computer using remote desktop if it is
not enabled and allowed through the firewall. The next group is offer remote assistance
helpers. Users in this group can offer unsolicited help to users on that computer using remote
assistance. If a user is not in this group, they can’t offer their help using remote
assistance unless they are invited. In order to invite another user, an invitation must
be created for remote assistance and then opened by the user wishing to help. Being
a member of this group simply means you can offer assistance using remote assistance without
waiting for an invitation to be created. Of course the user can always refuse the help,
invited or not, if they do not want it. The next group is network configuration operators.
Members of this group can change network settings like the IP address of the computer. They
can also renew and release DHCP information. If a regular user needs this access you can
simply add them to this group without adding them to the administrators group.
The next two groups relate to monitoring performance on the computer. The first group, performance
monitor users, allows members to monitor performance counters on the computer. This includes monitoring
from remote assuming that it has been configured. Certain operations like creating new data
collector sets used for monitor performance will not be available to this group. However,
members of this group could use a data collector set created by someone else.
The next group is performance log users. Members of this group can do everything performance
log users can do and also create data collector sets.
The next group is IIS_IUSRS. This group is used by Internet Information Services, formally
Internet Information Server or simply IIS. When IIS runs on a system, this group is used
to run the software. The permissions are set up to best allow the software to run without
having access to other parts of the system. The local group allows IIS data files to be
moved from one computer to another without having to change any permissions. You do not
need to add regular users to this group. The next group is replicator. This group is
used by the replicator service on a Domain Controller. The group should only have the
user that is used for replication on the domain controller. For this reason you should never
need to add users to this group. Windows Vista included a DFS replication service that may
have made use of this group. In Windows 7 this service has been removed. Even though
the group is included in Windows 7 there does not appear to be a use for it on Windows 7.
The next group is distrusted com users. Distributed Component Object Model, often referred to
as DCom, is a Microsoft technology that allows communication between distributed network
components. If you add a user to this group they can start, activate and use DCom objects
on that computer. The last group is cryptographic operators.
Members of this group can perform cryptographic operations on the computer. This means system
level cryptographic settings can be changed by this user. In normal day to day operations
you should never need to add a user to this group. This does not affect the user’s ability
to use encryption like IPSec or EFS. Unless you have a really special need, you are unlikely
to ever need to use this group. I will now change to my Windows 7 computer
to look at how to use default local groups. First open the control panel from the start
menu. From the control panel, select user accounts. From inside user accounts, select
the top option user accounts. This will show the basic user account administration tool.
For a standalone computer and for the average home user this interface will probably provide
enough functionality, but as we will see, for the domain administrator, features are
a bit lacking. To start making changes to the user accounts
on this system, select the option at the bottom, manage user accounts. From here you can perform
some basic user administration like resetting a user password. In this case, I want to make
some changes to the group membership of the users on this computer. To do this, make sure
the user you want to change is selected and press the properties button.
From the properties of the user, select the tab, group membership. Here you can see this
user is an administrator and thus a member of the administrators group. You could select
standard user if you wanted to make the user a regular user rather than an administrator.
You could also do the opposite if you wanted to change a standard user to an administrator.
When I select the option other from the pull down, notice that I can make this user a member
of all the other groups that I talked about earlier. The problem with this approach is
that it will change the user to be only a member of this group. If I change the user
to be a member of the event log readers, for example, the user would be able to read the
event logs. This would also mean the user would not be able to login to the computer
any more since the event log readers group does not grant the user this right.
A lot of domain administrators are going to want a lot more control over user management
than what is given here. If I cancel out of here and then select the advanced tab, in
the middle of the dialog is the option for advanced. If this is selected, the user account
snap in will be opened. This gives you a lot more control over the groups that a user is
a member of. Once I select groups I can see all the groups
that are on this system. To add a user to a group, right click the group and select
the option add to group. Notice that this dialog will also tell me which users are already
members of this group. The group IT Free Training Domain Admins has
been added to this group. When a computer is added to a domain, the domain admin’s
group for that domain is automatically added to the local administrators group on that
computer. This is what gives domain administrators administrator access to the computer. The
computer simply being a member of the domain does not provide this access. If I were to
remove this group no domain admins would be able to login to this computer even though
they are a domain administrator. If you want to add a user or group to the
local administrators group, press add and then enter in the user or group. I will add
the trainer account. This will give the domain account trainer administrator access to this
computer, but since I removed the domain admin group, all the other domain administrators
will not have administrator access. If I cancel out of here and this time right
click users and open the properties of the local users group, I can see who are members
of this group. Notice that the domain users group has automatically been added to the
local user groups when the computer was added to the domain. Being a domain user does not
give domain users access to the computer; the domain users group being a member of the
local users group is what gives domain users access to the computer. You can start to see
how a global group like domain user can be used to provide access in your organization
or access can be removed. Also notice in this group are the local groups “authenticated
users” and “interactive”. These groups don’t appear as groups in the admin tool
but are groups that the local system recognizes. There are a number of users and groups that
the system will recognize even though you won’t find them in any user manager. In
a later video I will cover these. Depending on which version of Windows 7 you
have and if you have a service pack installed, the options in the control panel may look
different. To access the user account admin tool you can also open computer configuration
from the start menu. From computer configuration select local users and groups and then select
groups. This is an easier way of accessing the local user’s administration tool.
That’s it for default local groups. In the next video I will look at the default groups
created at the domain level and groups that are unique to Windows Server 2008. I hope
this video was informative and thanks for watching.