Net User HUGE security problem?

[kopar]

Whoa! Call me a total noob, but isn't the NET USER, NET GROUP and other such commands a tremendous security problem in an Active Directory Domain?

Out of the box, any computer/user joined to the domain can do some pretty nifty things... Like ADD THEMSELVES TO THE DOMAIN ADMINS GROUP!

That's bad, mmkay. How in the world do I stop domain users from doing that, but still allow command prompt use?

HELP! I feel naked!

--Tom

 

[tfg13]

If your security is setup properly, then the net user command won't work for a domain user. My suggestion would be to setup your domain, apply your domain group policy, then as a "domain user", try it. You will be suprised at the results.