"Florian Frommherz [MVP]" <florian@PLEASELEAVETHISOUT.frickelsoft.net> wrote
in message news:uRFrsKsLIHA.4688@TK2MSFTNGP06.phx.gbl...
> Howdie!
>
> Laphan schrieb:
>> Didn't want to make them part of the domain admins groups so somebody
>> suggested that I add the domain users group (which they are part of) to
>> the laptop's local admins (ie via Computer Management / Users&Groups/
>> Groups/ Admins.
>>
>
> Don't make them admins. That's way too much. If those laptops are on
> Windows XP, you can use the "Network Operators" group to let them change
> IP and network configuration.

And don't add a generic AD group like "Domain Users" to *any* group with
privileges on a workstation. This is why "\RemS" recommended you create a
new AD group for the purpose - so that it can be managed.

/Al

> cheers,
>
> Florian
> --
> Microsoft MVP - Windows Server - Group Policy.
> eMail: prename [at] frickelsoft [dot] net.
> blog: http://www.frickelsoft.net/blog.