when a person logs into AD, what determines that person's local pe

[biff]

when a person logs into AD, what determines that person's local permission
level?

say this person does not have an account of the local machine but has rights
in AD to login with a domain account

what determines this domain users permission level to install programs, etc
and where would I make the changes to this domain users local (machine)
permission level?

 

[Brian Komar]

The permissions are determined based on the user's memberships reported on
the users access token. The memberships are then compared to the memberships
in the local groups (and Domain Local groups) in use at the local machine.
A member of the local Administrators can change local permission assignments
on the Security tab of a resource. local group memberships are performed in
the Users and Computers node of the Computer Management console.
Brian
"biff" <biff@discussions.microsoft.com> wrote in message
news:8F70597E-7708-4A56-8D20-14BBD51D5395@microsoft.com...
> when a person logs into AD, what determines that person's local permission
> level?
>
> say this person does not have an account of the local machine but has
> rights
> in AD to login with a domain account
>
> what determines this domain users permission level to install programs,
> etc
> and where would I make the changes to this domain users local (machine)
> permission level?