Local Users and Groups

Use Local Users and Groups to create and manage users and groups that are stored locally on a computer.

  • For tips about using Local Users and Groups, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Best practices

  • As a security best practice, it is recommended that you do not log on to your computer with administrative credentials.

    When you are logged on to your computer without administrative credentials, you can use Run as to accomplish administrative tasks.

    For more information, see Using Run as.

  • To further secure your local computer, it is recommended that you implement the following security guidelines:
    • Limit the number of users in the Administrators group since members of the Administrators group on a local computer have Full Control permissions on that computer.

      For more information, see Why you should not run your computer as an administrator.

    • Rename or disable the Administrator account.

      For more information, see Local user accounts.

    • Leave the Guest account disabled. The Guest account is used by people who do not have an actual account on the computer. The Guest account does not require a password, so it is a security risk. The Guest account is disabled by default, and it is recommended that it stay disabled.

      For more information, see Local user accounts.

    • Some default user rights assigned to specific default local groups may allow members of those groups to gain additional rights on your computer, including administrative rights. Therefore, your organization must equally trust all personnel that are members of the Administrators, Power Users, Print Operators, and Backup Operators groups.

      For more information about these groups, see Default local groups.

    • Review important security considerations about local users and groups.

      For more information, see Default security settings for groups.

  • Use passwords no longer than 14 characters if you are on a network with computers running Windows 95 and Windows 98.

    • You can create a password containing up to 127 characters. However, computers running Windows 95 and Windows 98 support passwords up to only 14 characters. If your password is longer, you may not be able to log on to the network from those computers.

    For more information, see To create a local user account.


How to...

  • Manage local users
  • Manage local groups
  • Start programs as an administrator


Manage local users

  • Create a local user account
  • Reset the password for a local user account
  • Disable or activate a local user account
  • Delete a local user account
  • Rename a local user account
  • Assign a logon script to a local user account
  • Assign a home folder to a local user account


Create a local user account

Microsoft Windows graphic

To create a local user account

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. On the Action menu, click New User.
  4. Type the appropriate information in the dialog box.
  5. Select or clear the check boxes for:
    • User must change password at next logon
    • User cannot change password
    • Password never expires
    • Account is disabled
  6. Click Create, and then click Close.

Notes

  • XOX
  • XOX
  • A user name cannot be identical to any other user or group name on the computer being administered. It can contain up to 20 uppercase or lowercase characters, except for the following:

    " / \ [ ] : ; | = , + * ? < >

    A user name cannot consist solely of periods (.) or spaces.

  • In Password and Confirm password, you can type a password containing up to 127 characters. However, if the network consists of computers running Windows 95 or Windows 98, consider using passwords no longer than 14 characters. If your password is longer, you may not be able to log on to the network from those computers.
  • The use of strong passwords and appropriate password policies can help protect your computer from attack. For more information, see Related Topics.

Related Topics


Reset the password for a local user account

Microsoft Windows graphic

To reset the password for a local user account

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account for which you want to reset the password, and then click Set Password.
  4. Read the warning message, and if you want to continue, click Proceed.
  5. In New password and in Confirm password, type a new password and then click OK.

Notes

  • To perform this procedure, you must be the member of the Power Users group who created the account or a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • Strong passwords improve computer and network security. For more information, see Related Topics.
  • Resetting a local user account password may result in some data loss for that user. For more information, see Related Topics.

Related Topics


Disable or activate a local user account

Microsoft Windows graphic

To disable or activate a local user account

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account you want to change, and then click Properties.
  4. Do one of the following:
    • To disable the selected user account, select the Account is disabled check box.
    • To activate the selected user account, clear the Account is disabled check box.

Notes

  • To perform this procedure, you must be the member of the Power Users group who created the account or a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • When a user account is disabled, the user is not permitted to log on. The account appears in the details pane with an X on the icon.
  • Before activating a disabled account, ensure that the account was not locked out for security reasons. For more information, see Related Topics.
  • When a user account is activated, the user is permitted to log on normally.

Related Topics


Delete a local user account

Microsoft Windows graphic

To delete a local user account

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account that you want to delete, and then click Delete.

Notes

  • To perform this procedure, you must be the member of the Power Users group who created the account or a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • When you need to delete a user account, it is recommended that you first disable the account. When you are certain that disabling the account has not caused a problem, you can safely delete it.
  • A deleted user account cannot be recovered.
  • The Administrator and Guest account cannot be deleted.
Related Topics


Rename a local user account

Microsoft Windows graphic

To rename a local user account

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account you want to rename, and then click Rename.
  4. Type the new user name, and then press ENTER.

Notes

  • To perform this procedure, you must be the member of the Power Users group who created the account or a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • Because it retains its security identifier (SID), a renamed user account retains all its other properties, such as its description, password, group memberships, user profile, account information, and any assigned permissions and user rights.
  • A user name cannot be identical to any other user or group name of the computer being administered. It can contain up to 20 uppercase or lowercase characters, except for the following:

    • " / \ [ ] : ; | = , + * ? < >

    A user name cannot consist solely of periods (.) or spaces.

Related Topics


Assign a logon script to a local user account

Microsoft Windows graphic

To assign a logon script to a local user account

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account you want, and then click Properties.
  4. On the Profile tab, in Logon script, type the file name and relative path of the script.

Notes

  • To perform this procedure, you must be the member of the Power Users group who created the account or a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • Logon scripts can contain malicious commands. It is recommended that you be familiar with the contents of the logon script before assigning it to a user.
  • Logon scripts that are stored on a local computer apply only to users logging on to that local computer.
  • Local logon scripts must be stored in a shared folder, or subfolders of the shared folder, named Netlogon. If this folder does not exist by default, you must create it. To specify a logon script that is stored in a subfolder of the Netlogon folder, precede the file name with the relative path to that folder. For example, to assign the Startup.bat logon script stored in \\ComputerName\Netlogon\FolderName to a local user, in Logon script, type: FolderName\Startup.bat

Related Topics


Assign a home folder to a local user account

Microsoft Windows graphic

To assign a home folder to a local user account

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Users
  3. Right-click the user account for which you want to specify a home folder, and then click Properties.
  4. On the Profile tab, do one of the following:
    • To specify a local home folder, click Local path, and then type the path. For example, c:\users\nicolette
    • To specify a home folder on a shared resource, click Connect, click the proper drive letter, and then type the network path. For example, \\airedale\users\nathan

Notes

  • To perform this procedure, you must be the member of the Power Users group who created the account or a member of the Administrators group on the local computer or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • The My Documents folder provides a convenient alternative to home folders, but does not replace them. Each user has a My Documents folder on the boot volume. XOX
  • XOX
  • If no home folder is assigned, the system assigns a default local home folder to the user account (on the root directory where the operating system files are installed as the initial version).
  • To specify a network path for the home folder, you must first create the shared resource and set permissions that allow the user access.

Related Topics


Manage local groups

  • Create a local group
  • Add a member to a local group
  • Identify members of a local group
  • Delete a local group
  • Allow members of the Anonymous Logon group to be members of the Everyone group on a local computer


Create a local group

Microsoft Windows graphic

To create a local group

Using the Windows interface

  1. Open Computer Management.
  2. In the console tree, click Groups.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Groups
  3. On the Action menu, click New Group.
  4. In Group name, type a name for the new group.
  5. In Description, type a description of the new group.
  6. To add one or more members to the new group, click Add.
  7. In the Select Users, Computers, or Groups dialog box, do the following:
    • To add a user or group account to this group, under Enter the object names to select, type the name of the user account or group account that you want to add, and then click OK.
    • To add a computer account to this group, click Object Types, select the Computers check box, and then click OK. Under Enter the object names to select, type the name of the computer account that you want to add, and then click OK.
  8. In the New Group dialog box, click Create, and then click Close.

Notes

  • XOX
  • XOX
  • A local group name cannot be identical to any other group or user name on the local computer being administered. It can contain up to 256 uppercase or lowercase characters, except for the following:

    " / \ [ ] : ; | = , + * ? < >

    A group name cannot consist solely of periods (.) or spaces.

Using a command line

  1. Open Command Prompt.
  2. To create a group, type:

    net localgroup GroupName /add

Notes

  • XOX
  • XOX
  • A local group name cannot be identical to any other group or user name on the local computer being administered. It can contain up to 256 uppercase or lowercase characters, except for the following:

    " / \ [ ] : ; | = , + * ? < >

    A group name cannot consist solely of periods (.) or spaces.

  • For more information about the net localgroup command, see Related Topics.

Related Topics


Add a member to a local group

Microsoft Windows graphic

To add a member to a local group

Using the Windows interface

  1. Open Computer Management.
  2. In the console tree, click Groups.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Groups
  3. Right-click the group in which you want to add a member, click Add to Group, and then click Add.
  4. In the Select Users, Computers, or Groups dialog box, do the following:
    • To add a user account or group account to this group, under Enter the object names to select, type the name of the user account or group account that you want to add to the group, and then click OK.
    • To add a computer account to this group, click Object Types, select the Computers check box, and then click OK. Under Enter the object names to select, type the name of the computer account that you want to add to the group, and then click OK.

Notes

  • To perform this procedure, you must be the member of the Power Users group who created the account or a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • To remove a member from a local group, select the user account, computer account, or group account in Members, and then click Remove.
  • All the rights and permissions assigned to a group are assigned to all members of that group. For more information, see Related Topics.
  • Limit the number of users in the Administrators group since members of the Administrators group on a local computer have Full Control permissions on that computer.
  • If the computer is joined to a domain, you can add user accounts, computer accounts, and group accounts from that domain and from trusted domains to a local group.

Using a command line

  1. Open Command Prompt.
  2. To add a member to the Power Users group, type:

    net localgroup "PowerUsersGroupName" "MemberName"/add

    You must include the quotation marks.

Notes

  • To perform this procedure, you must be the member of the Power Users group who created the account or a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • All the rights and permissions assigned to a group are assigned to all members of that group. For more information, see Related Topics.
  • Limit the number of users in the Administrators group since members of the Administrators group on a local computer have Full Control permissions on that computer.
  • If the computer is joined to a domain, you can add user accounts, computer accounts, and group accounts from that domain and from trusted domains to a local group.

Related Topics


Identify members of a local group

Microsoft Windows graphic

To identify members of a local group

Using the Windows interface

  1. Open Computer Management.
  2. In the console tree, click Groups.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Groups
  3. Right-click the group in which you want to identify members, and click Properties.

Notes

  • XOX
  • XOX

Using a command line

  1. Open Command Prompt.
  2. To list members of the Power Users group, type:

    net localgroup "PowerUsersGroupName"

    You must include the quotation marks.

Notes

  • XOX
  • XOX
  • For more information about the net localgroup command, see Related Topics.

Related Topics


Delete a local group

Microsoft Windows graphic

To delete a local group

Using the Windows interface

  1. Open Computer Management.
  2. In the console tree, click Groups.

    Where?

    • Computer Management
    • System Tools
    • Local Users and Groups
    • Groups
  3. Right-click the group you want to delete, and then click Delete.

Notes

  • To perform this procedure, you must be the member of the Power Users group who created the account or a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • The following default groups cannot be deleted:
    • Administrators
    • Backup Operators
    • Guests
    • Network Configuration Operators
    • Performance Log Users
    • Performance Monitor Users
    • Power Users
    • Print Operators
    • Remote Desktop Users
    • Replicator
    • Users
  • A deleted group cannot be recovered.
  • Deleting a local group removes only the group; it does not delete the user accounts, computer accounts, or group accounts that were members of that group.
  • If you delete a group and then create another group with the same group name, you must set new permissions for the new group; it will not inherit the permissions that were assigned to the old group.

Using a command line

  1. Open Command Prompt.
  2. To delete a group, type:

    net localgroup GroupName /delete

Notes

  • To perform this procedure, you must be the member of the Power Users group who created the account or a member of the Administrators group on the local computer. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
  • XOX
  • The following default groups cannot be deleted:
    • Administrators
    • Backup Operators
    • Guests
    • Network Configuration Operators
    • Performance Log Users
    • Performance Monitor Users
    • Power Users
    • Print Operators
    • Remote Desktop Users
    • Replicator
    • Users
  • A deleted group cannot be recovered.
  • Deleting a local group removes only the group; it does not delete the user accounts, computer accounts, or group accounts that were members of that group.
  • If you delete a group and then create another group with the same group name, you must set new permissions for the new group; it will not inherit the permissions that were granted to the old group.
  • For more information about the net localgroup command, see Related Topics.

Related Topics


Allow members of the Anonymous Logon group to be members of the Everyone group on a local computer

Microsoft Windows Graphic

To allow members of the Anonymous Logon group to be members of the Everyone group on a local computer

  1. Open Local Security Settings.
  2. In the console tree, double-click Local Policies, and then click Security Options.
  3. In the details pane, right-click Network access: Let Everyone permissions apply to anonymous users, and then click Properties.
  4. On the Local Security Settings tab, click Enabled.

Notes

  • XOX
  • To open Local Security Settings, click Start, point to All Programs, point to Administrative Tools, and then click Local Security Policy.
  • By default, the inclusion of the Everyone security group in the anonymous user access token is disabled.

Related Topics


Start programs as an administrator

  • Run a program with administrative credentials
  • Create a shortcut using the runas command


Run a program with administrative credentials

Microsoft Windows Graphic

To run a program with administrative credentials

Using the Windows interface

  1. In Windows Explorer, or on the Start menu, right-click the program executable file (or icon) that you want to open, and then click Run as.
  2. Click The following user.
  3. In User name and Password, type the administrator account name and password.

Notes

  • The use of Run as is not limited to administrator accounts.
  • You can use Run as to start a program in the context of an administrator account. The administrator context is only used for that specific program and is only available until that program is closed.
  • You can also use Run as to start two separate instances of an administrative application, such as Active Directory Domains and Trusts. Each instance can be directed at a different domain or forest to more efficiently perform interdomain or interforest administration tasks.
  • You can open most Control Panel items using Run as by holding down the SHIFT key, and then right-clicking the item.
  • Some programs do not support Run as.
  • If you try to start a program, such as Microsoft Management Console (MMC) or a Control Panel item, from a network location using Run as, it could fail if the credentials used to connect to the shared resource are different from the credentials used to start the program. The credentials used to run the program might not be able to gain access to the same shared resource. For more information about troubleshooting the runas command, see Related Topics.
  • If Run as fails, the Secondary Logon service may not be running. For more information about how to start a service, see Related Topics.

Using a command line

  1. Open Command Prompt.
  2. To run a program, type:

    runas /user:UserName program PathToFilename

Value | Description
UserName | Specifies the user credentials to use when running the specified program. You can use the format user@domain or domain\user.
PathToFilename | Specifies the file name (and path to the file name) that you want to open with the specified program. For example, to open Active Directory Users and Computers, use the following format: "mmc %windir%\system32\dsa.msc" To open a specific file using Notepad, use the following format: "notepad \"myfile.txt"\"

Notes

  • XOX
  • The use of the runas command is not limited to administrator accounts.
  • You can use the runas command to start a program in the context of an administrator account. The administrator context is only used for that specific program and is only available until that program is closed.
  • You can also use the runas command to start two separate instances of an administrative application, such as Active Directory Domains and Trusts. Each instance can be directed at a different domain or forest to more efficiently perform interdomain or interforest administration tasks.
  • Some programs do not support the runas command.
  • If you try to start a program, such as Microsoft Management Console (MMC) or a Control Panel item, from a network location using the runas command, it could fail if the credentials used to connect to the shared resource are different from the credentials used to start the program. The credentials used to run the program might not be able to gain access to the same shared resource. For more information about troubleshooting the runas command, see Related Topics.
  • If the runas command fails, the Secondary Logon service may not be running. For more information about how to start a service, see Related Topics.

Related Topics


Create a shortcut using the runas command

Microsoft Windows graphic

To create a shortcut using the runas command

  1. Right-click the desktop, point to New, and then click Shortcut.
  2. In Type the location of the item, type runas and the command parameters you want to use. In the following table, see examples for creating shortcuts.
  3. Click Next, type a name for the shortcut, and then click Finish.

Examples

To create a shortcut to | Type
A command prompt with administrative credentials | runas /user:ComputerName\administrator cmd
Computer Management with administrative credentials | runas /user:ComputerName\administrator "mmc %windir%\system32\compmgmt.msc"
Active Directory Users and Computers with domain administrative credentials | runas /user:DomainName\administrator "mmc %windir%\system32\dsa.msc"
Active Directory Users and Computers in another forest. | runas /netonly /user:DomainName\UserName "mmc %windir%\system32\dsa.msc"

Notes

  • XOX
  • Use this procedure if you want to perform administrative tasks when you are logged on as a member of another group. The use of the runas command is not limited to administrator accounts.
  • Microsoft Management Consoles (MMC) will not display the credentials under which it is running. Be aware of this when you are using the runas command.
  • Some programs do not support the runas command.
  • If you try to start a program, such as Microsoft Management Console (MMC) or a Control Panel item, from a network location using the runas command, it could fail if the credentials used to connect to the shared resource are different from the credentials used to start the program. The credentials used to run the program might not be able to gain access to the same shared resource. For more information about troubleshooting the runas command, see Related Topics.
  • If the runas command fails, the Secondary Logon service may not be running. For more information about how to start a service, see Related Topics.

Related Topics


Concepts

This section provides general background information about Local Users and Groups:
  • Understanding Local Users and Groups
  • Administering Local Users and Groups


Understanding Local Users and Groups

This section covers:

  • Local Users and Groups overview
  • Local user accounts
  • Default local groups


Local Users and Groups overview

Local Users and Groups is located in Computer Management, a collection of administrative tools that you can use to manage a single local or remote computer. You can use Local Users and Groups to secure and manage user accounts and groups stored locally on your computer. A local user or group account can be assigned permissions and rights on a particular computer and that computer only. Local Users and Groups is available on the following client and server operating systems:

  • Client computers running Microsoft® Windows® 2000 Professional or XOX
  • Member servers running a product in the Microsoft Windows 2000 Server family or the Windows Server 2003 family
  • Stand-alone servers running a product in the Microsoft Windows 2000 Server family or the Windows Server 2003 family

Using Local Users and Groups you can limit the ability of users and groups to perform certain actions by assigning them rights and permissions. A right authorizes a user to perform certain actions on a computer, such as backing up files and folders or shutting down a computer. A permission is a rule associated with an object (usually a file, folder, or printer), and it regulates which users can have access to the object and in what manner.

You cannot use Local Users and Groups to view local user and group accounts once a member server has been promoted to a domain controller. However, you can use Local Users and Groups on a domain controller to target remote computers (that are not domain controllers) on the network. Use Active Directory Users and Computers to manage users and groups in Active Directory.

For more information, see:

  • Local user accounts
  • Default local groups
  • Default security settings for groups
  • Active Directory Users and Computers


Local user accounts

The Users folder located in the Local Users and Groups Microsoft Management Console (MMC) displays the default user accounts as well as the user accounts you create. These default user accounts are created automatically when you install a stand-alone server or member server running Windows Server 2003. The following table describes each default user account on servers running Windows Server 2003.

Default user account | Description
Administrator account The Administrator account has full control of the server and can assign user rights and access control permissions to users as necessary. This account must be used only for tasks that require administrative credentials. It is highly recommended that you set up this account to use a strong password. For more information, see Strong passwords. For additional security considerations for accounts with administrative credentials, see Best practices.

The Administrator account is a member of the Administrators group on the server. The Administrator account can never be deleted or removed from the Administrators group, but it can be renamed or disabled. Because the Administrator account is known to exist on many versions of Windows, renaming or disabling this account will make it more difficult for malicious users to try and gain access to it. For more information about how to rename or disable a user account, see To rename a local user account and To disable or activate a local user account.

The Administrator account is the account you use when you first set up the server. You use this account before you create an account for yourself.

Important

  • Even when the Administrator account has been disabled, it can still be used to gain access to a computer using Safe Mode.
Guest account The Guest account is used by people who do not have an actual account on the computer. A user whose account is disabled, but not deleted, can also use the Guest account. The Guest account does not require a password. The Guest account is disabled by default, but you can enable it.

You can set rights and permissions for the Guest account just like any user account. By default, the Guest account is a member of the default Guests group, which allows a user to log on to a server. Additional rights, as well as any permissions, must be granted to the Guests group by a member of the Administrators group. The Guest account is disabled by default, and it is recommended that it stay disabled.
HelpAssistant account (installed with a Remote Assistance session) | The primary account used to establish a Remote Assistance session. This account is created automatically when you request a Remote Assistance session and has limited access to the computer. The HelpAssistant account is managed by the Remote Desktop Help Session Manager service and will be automatically deleted if no Remote Assistance requests are pending. For more information about Remote Assistance, see Administering Remote Assistance.

For more information about creating and managing local user accounts, see Manage local users.


Default local groups

The Groups folder located in the Local Users and Groups Microsoft Management Console (MMC) displays the default local groups as well as the local groups that you create. The default local groups are automatically created when you install a stand-alone server or a member server running Windows Server 2003. Belonging to a local group gives a user the rights and abilities to perform various tasks on the local computer. For more information about domain-based groups, see Default groups.

You can add local user accounts, domain user accounts, computer accounts, and group accounts to local groups. However, you cannot add local user accounts and local group accounts to domain group accounts. For more information about adding members to local groups, see To add a member to a local group.

Note

  • To learn what group you need to be a member of to perform a particular procedure, many procedural topics under How To in Help and Support Center provide a note that identifies this information.

The following table provides descriptions of the default groups located in the Groups folder and lists the assigned user rights for each group. These rights are assigned within the local security policy. For complete descriptions of the user rights listed in the table, see User rights assignment. For information about editing these rights, see To assign user rights for your local computer.

Group | Description | Default user rights
Administrators | Members of this group have full control of the server and can assign user rights and access control permissions to users as necessary. The Administrator account is also a default member. When this server is joined to a domain, the Domain Admins group is automatically added to this group. Because this group has full control of the server, add users with caution. | Access this computer from the network; Adjust memory quotas for a process; Allow log on locally; Allow log on through Terminal Services; Back up files and directories; Bypass traverse checking; Change the system time; Create a pagefile; Debug programs; Force shutdown from a remote system; Increase scheduling priority; Load and unload device drivers; Manage auditing and security log; Modify firmware environment variables; Perform volume maintenance tasks; Profile single process; Profile system performance; Remove computer from docking station; Restore files and directories; Shut down the system; Take ownership of files or other objects.
Backup Operators | Members of this group can back up and restore files on the server, regardless of any permissions that protect those files. This is because the right to perform a backup takes precedence over all file permissions. They cannot change security settings. | Access this computer from the network; Allow log on locally; Back up files and directories; Bypass traverse checking; Restore files and directories; Shut down the system.
DHCP Administrators (installed with the DHCP Server service) | Members of this group have administrative access to the Dynamic Host Configuration Protocol (DHCP) Server service. This group provides a way to assign limited administrative access to the DHCP server only, while not providing full access to the server. Members of this group can administer DHCP on a server using the DHCP console or the Netsh command, but are not able to perform other administrative actions on the server. | No default user rights.
DHCP Users (installed with the DHCP Server service) | Members of this group have read-only access to the DHCP Server service. This allows members to view information and properties stored at a specified DHCP server. This information is useful to support staff when they need to obtain DHCP status reports. | No default user rights.
Guests | Members of this group will have a temporary profile created at log on, and when the member logs off, the profile will be deleted. The Guest account (which is disabled by default) is also a default member of this group. | No default user rights.
HelpServicesGroup | This group allows administrators to set rights common to all support applications. By default, the only group member is the account associated with Microsoft support applications, such as Remote Assistance. Do not add users to this group. | No default user rights.
Network Configuration Operators | Members of this group can make changes to TCP/IP settings and renew and release TCP/IP addresses. This group has no default members. | No default user rights.
Performance Monitor Users | Members of this group can monitor performance counters on the server locally and from remote clients without being a member of the Administrators or Performance Log Users groups. | No default user rights.
Performance Log Users | Members of this group can manage performance counters, logs and alerts on the server locally and from remote clients without being a member of the Administrators group. | No default user rights.
Power Users | Members of this group can create user accounts and then modify and delete the accounts they have created. They can create local groups and then add or remove users from the local groups they have created. They can also add or remove users from the Power Users, Users, and Guests groups. Members can create shared resources and administer the shared resources they have created. They cannot take ownership of files, back up or restore directories, load or unload device drivers, or manage security and auditing logs. | Access this computer from the network; Allow log on locally; Bypass traverse checking; Change the system time; Profile single process; Remove computer from docking station; Shut down the system.
Print Operators | Members of this group can manage printers and print queues. | No default user rights.
Remote Desktop Users | Members of this group can remotely log on to a server. For more information, see Enabling users to connect remotely to the server. | Allow log on through Terminal Services.
Replicator | The Replicator group supports replication functions. The only member of the Replicator group should be a domain user account used to log on the Replicator services of a domain controller. Do not add user accounts of actual users to this group. | No default user rights.
Terminal Server Users | This group contains any users who are currently logged on to the system using Terminal Server. Any program that a user can run with Windows NT 4.0 will run for a member of the Terminal Server User group. The default permissions assigned to this group enable its members to run most earlier programs. | No default user rights
Users | Members of this group can perform common tasks, such as running applications, using local and network printers, and locking the server. Users cannot share directories or create local printers. By default, the Domain Users, Authenticated Users, and Interactive groups are members of this group. Therefore, any user account created in the domain becomes a member of this group. | Access this computer from the network; Allow log on locally; Bypass traverse checking.
WINS Users (installed with WINS service) | Members of this group are permitted read-only access to Windows Internet Name Service (WINS). This allows members to view information and properties stored at a specified WINS server. This information is useful to support staff when they need to obtain WINS status reports. | No default user rights.

For more information about the most common default groups, see Default security settings for groups.


Administering Local Users and Groups

This section covers:

  • Managing files for local user accounts
  • Managing local groups from the command line
  • Why you should not run your computer as an administrator


Managing files for local user accounts

Administrators can use home folders and My Documents to collect user files in one location. User files located in one place simplifies the backup process and makes access control management easier to maintain.

Home folders can be a local folder or a folder located on a shared resource and can be assigned to a single user or many users. When a home folder is assigned to a user, it becomes the user's default folder for the Open and Save As dialog boxes, for command prompt sessions, and for all programs without a defined working folder.

The My Documents folder is an alternative for home folders, but it does not replace them. When a user tries to save or open a file, most programs determine whether to use the home folder or My Documents in one of two ways:

  • Some programs first look in the home folder for files that match the type of file that is to be opened or saved (for example, *.doc or *.txt). If a file with that extension is found, the program opens the home folder and ignores My Documents. If a file of that type is not found, the program opens My Documents.
  • In other programs, the home folder is ignored, regardless of whether the home folder contains any files.

For more information about how to assign home folders, see To assign a home folder to a local user account.

When upgrading servers from Windows NT 4.0 or earlier, programs that have stored documents in the home folder will continue to open and save documents in the home folder. However, if a program is installed after you have upgraded, the program uses My Documents to open and save files.


Managing local groups from the command line

The following command-line tool can be used to manage local groups.

Name | Description
Net localgroup | This command adds, displays, or modifies local groups.

Additional command-line tools are available in the Support tools folder of the product compact disc and from the Resource Kits.

For information about other command-line tools, see Command-line reference.


Why you should not run your computer as an administrator

Running your computer as a member of the Administrators group makes the system vulnerable to Trojan horses and other security risks. The simple act of visiting an Internet site or opening an e-mail attachment can be damaging to the system. An unfamiliar Internet site or e-mail attachment may have Trojan horse code that can be downloaded to the system and executed.

If you are logged on as an administrator of a local computer, a Trojan horse could reformat your hard drive, delete your files, and create a new user account with administrative access. If you are logged on as a member of the Domain Admins group, Enterprise Admins group, or Schema Admins group in Active Directory, a trojan horse could create a new domain user account with administrative access and put schema, configuration, or domain data at risk.

On a local computer, it is recommended that you add your domain user account only to the Users group (and not to the Administrators group) to perform routine tasks, including running programs and visiting Internet sites. When it becomes necessary to perform administrative tasks on the local computer or in Active Directory, use Run as to start a program using administrative credentials.

Run as allows you to accomplish administrative tasks without exposing your computer or data stored in Active Directory to unnecessary risk. For more information, see Using Run as. For more information about how to use Run as, see To run a program with administrative credentials.

If you need to perform administrative tasks, such as upgrading the operating system or configuring system parameters, then log off and log back on as an administrator.


Troubleshooting

What problem are you having?

Received the "The local policy of this system does not permit you to logon interactively" error message, or unable to log on locally.

Cause: The ability to log on locally to a stand-alone server or member server running Windows Server 2003 is controlled by local security policy.

Solution: Add the user account to the Users local group or use the local security policy to assign the particular user or group the right to Allow log on locally.

See also: Allow log on locally;To assign user rights for your local computer;Local Security Policy overview

Runas command failed.

Cause: The Secondary Logon service is not running.

Solution: Start the Secondary Logon service.

See also: To start, stop, pause, resume, or restart a service

Cause: The Secondary Logon service is running; however, you do not have permissions on the shared resource that is running the Secondary Logon service.

Solution: Verify that your local user account in Computer Management has the permissions needed to access the shared resource on which the Secondary Logon service is installed. To view permissions in Computer Management, in Control Panel, double-click Administrative Tools, and then double-click Computer Management.

See also: Runas

Cause: The Secondary Logon service is running; however, you cannot start or install a program from a shared resource using the runas command.

Solution: Using the runas command, map a network drive to the shared resource using administrative credentials from your local computer, and then start the program again. To do this, open a command prompt by typing the following command in the Run dialog box:

runas /user:administrator cmd

When prompted, type the administrative password and when the command prompt appears, type:

net use z: \\Server\Share /user:DomainName\UserName *

This will connect you to the shared resource while still under the security context of the local administrator account.

See also: Runas

Cannot log on to a network computer running Windows 95 or Windows 98.

Cause: Your password is longer than 14 characters.

Solution: Create a new user account or change your password to the 14 character maximum for Windows 95 and Windows 98.

See also: To reset the password for a local user account

Cannot access the Computer Management extension snap-ins on a remote computer.

Cause: The Remote Registry service is not running on the remote computer.

Solution: Ensure that the Remote Registry service is started on the remote computer. You need appropriate permissions on the remote computer to start the service.

See also: To start, stop, pause, resume, or restart a service

Note

  • You might also receive this error message if the remote computer is running Windows 95. Computer Management does not support remote access to computers that are running Windows 95.