Hi, I want to give some rights to users like install drivers and softwares, but don't want them change the domain by themselves? Can windows7 offer such a feature? How to set it? Thanks.Don Hou

hi, you can do it by group policy, you can hide the 'computername' tab you need to change the security of 'netid.dll' file located in system32 and remove the local Admins from the list, or change them to your IT personnel for example. you can do it by GP - once computer joins to domain you can do it by running batch or script using CACLs (cacls c:\windows\system32\netid.dll..........) in both cases you need a revert script, the catch is that you need to take ownership on a file before you can add the Admin back. In windows the revert script might not work because of security of windows 7, this is a little tricky even. Regards George www.supportweblog.com

hi, you can do it by group policy, you can hide the 'computername' tab you need to change the security of 'netid.dll' file located in system32 and remove the local Admins from the list, or change them to your IT personnel for example. you can do it by GP - once computer joins to domain you can do it by running batch or script using CACLs (cacls c:\windows\system32\netid.dll..........) in both cases you need a revert script, the catch is that you need to take ownership on a file before you can add the Admin back. In windows the revert script might not work because of security of windows 7, this is a little tricky even. Regards George www.supportweblog.com Hi, We have our computers in domain, can you make it in more details for me? like step by step with GP.. Thanks. DonDon Hou

Computer Configuration (Enabled) | Policies | Windows Setting | File System %SystemRoot%\system32\netid.dll Configure this file or folder then: Replace existing permissions on all subfolders and files with inheritable permissions Allow your-domain\Domain Admins Full Control This folder, subfolders and files Allow NT AUTHORITY\SYSTEM Full Control This folder, subfolders and files Allow your-domain\local-admin(member of IT personnel) Full Control This folder, subfolders and files Allow inheritable permissions from the parent to propagate to this object and all child objects Disabled Regards George www.supportweblog.com

Computer Configuration (Enabled) | Policies | Windows Setting | File System %SystemRoot%\system32\netid.dll Configure this file or folder then: Replace existing permissions on all subfolders and files with inheritable permissions Allow your-domain\Domain Admins Full Control This folder, subfolders and files Allow NT AUTHORITY\SYSTEM Full Control This folder, subfolders and files Allow your-domain\local-admin(member of IT personnel) Full Control This folder, subfolders and files Allow inheritable permissions from the parent to propagate to this object and all child objects Disabled Regards George www.supportweblog.com

Hi Don Hou, How's it going? Did you follow George Fr's method? If you have any questions on this topic, please feel free to let us know. Regards, Miya TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.comThis posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Miya, Got the answer, but have not tried it yet.. will let you know if it fit my requriement later.. Many Thanks... DonDon Hou

As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as 'Answered' as the previous steps should be helpful for many similar scenarios. If the issue still persists, please feel free to reply this post directly so we will be notified to follow it up. Thanks for your understanding and cooperation! Regards, Miya TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tnmff@microsoft.comThis posting is provided "AS IS" with no warranties, and confers no rights. | Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.