need help with editing domain users on 2003 network

[techguy21801]

hi all heres the jist.

got a network with win 2003 server as domain controllers, running windows 2000 and windows xp clients

heres the problem we recently changed to this setup and in the process to quickly fix a problem we added the user domain users to the local admin group to give the local users access to make registry edits.

well now we don't want them to have such rights only users rights. well we tried just removing domain users from the administrators group, then the problems started when we logged back into the users account thei outlook express idenity was gone, and the desktop back ground. so we tried adding domain users bak to the users group that didn't work, then we added it back to administrators, that worked, is there any way for me to fix this, we can not set the policy netowrk wide either. any ideas

thanks

p.s.

we just found out also that with out that domain users account in their various machines run extremmely slow. don't know if thats related or not

Edited January 31, 2006 by techguy21801

[nitroshift]

are you running active directory?

Edited February 1, 2006 by nitroshift

[techguy21801]

yes

[nitroshift]

you can change their membership from the active directory services on the server running w2k3. not very sure how to do that at the moment as i'm at home but i'll have a look tomorrow at work (i've got a w2k3 server that i've set up) and will let you know. hope that's good enough for now.

[techguy21801]

thx but wouldn't that change it for everyone domian users?

[nitroshift]

nope. in active directory choose the user(s) you want to edit and change their membership.

[nitroshift]

hi again. as promised. here's the path to changing the membership of the domain users: administrative tools --> active directory users and computers. here you choose the user you want to restrain the access to and delete its membership then add it again with the level you want. let me know if it worked for you. it did for me.