2003 AD Default Domain Policy

[Microsoft-man]

Guys. We have just built a Windows 2003 AD Domain and am looking at the Default Domian Policy. Now according to Microsoft and i am just using this policy as an examle.

Allow Log On Locally

The Default Setting is

Workstations & Servers

Administrators

Backup Operators

Power Users

Users

Guest

On Domain Controllers

Account Operators

Administrators

Backup Operators

Print Operators

Server Operators

Now thw Domain Controllers part i am not worried about as this was set by default.

My issue comes in that Power Users is a local Group. If i wanted to remove the Power Users group from this right would i have to enable or disable it on the local machine? What if i wanted to do that for all computers in my domain

Can anyone give me a hand as i am having real issues with these Domain

Thanks in advanced

[DiGGiTY]

You don't have to manually disable anything to remove log on locally from Power Users . This is all accomplished via Group Policy. When a workstation is a member of the domain, and someone logs on, the Default Domain Policy is applied to the workstation. If you remove the log on locally right from Power Users, each computer in the domain on the next logon will have that policy applied.