user right

[Hitesh0528]

I have a problem..
i want to have user have restricted user rights and not power user right and i tried everything but not matter what i change somoene always gets a error like they cant access there e-mail..can run certain programs..cant update windows...and sometimes there account get deleted..waht rigths should i give to a user just so that they can do those things and not beable to mess up the network..if they mess up there machine then its there problem but i dont want them to mess up the network...dont know what to do...

 

[Seaspray0]

A typical user should have domain user rights on the domain (which is the default and applied to all domain accounts). Create domain groups to define specific groups in your environment... like executive group, technology group, engineering group, payroll group, computer admin group, etc. Create a domain group called client administrators and do not assign any domain resources to it. Assign users to these special groups as needed. Join your client computers to the domain, and when you do so, add the domain group "client administrators" to the local administrator's group on each pc. Add each desktop tech support person to the domain group "client administrators". They have local administrator rights on all the PC's but no domain administrator rights from this group. As for the average domain user, do not give them any rights on the local computers what-so-EVER!!! You can use group policy to assign and publish software to your users, and have that software installed using the "client administrators account" at that (through the group policy). Users do not need, nor should they get any rights to install software on their own. It sounds cruel, but it is necessary if you are to prevent users from installing unauthorized software.