Built-in Local Groups

By Author: fiona
Total Articles: 191
Comment this article

All stand-alone servers, member servers, and computers running a 220-701 have built-in local groups. Built-in local groups give users the rights to perform system tasks on a single computer, such as backing up and restoring files, changing the system time, and administering system resources. Windows Server 2003 places the built-in local groups into the Groups folder in the Local Users and Groups snap-in in the Computer Management console. Table 8-5 describes the capabilities that members of the most commonly used built-in local groups have. Except where noted, there are no initial members in these groups.
Members can perform all administrative tasks on the computer. By default, the built-in Administrator user account for the computer is a member. When a member server or computer running Windows XP Professional joins a domain, Windows Server 2003 adds the Domain Admins predefined global group to this group.
Members can use Windows Backup to back up and restore the computer.
Members can perform only tasks for which you have specifically granted rights and can gain access ...
... only to resources for which you have assigned permissions; members cannot make permanent changes to their desktop environment. By default, the built-in Guest account for the computer is a member.
Members can set rights common to all support applications. By default, the only member is the account associated with Microsoft support applications. Do not add users to this group.
Members can make changes to get a+ certified online settings and renew and release TCP/IP addresses. This group has no default members.
Members can monitor performance counters on the server locally and from remote clients without being a member of the Administrators or Performance Log Users groups.
Members can manage performance counters, logs, and alerts on the server locally and from remote clients without being a member of the Administrators or Performance Monitor Users groups.
Members can create and modify local user accounts on the computer and share resources.
Members can perform only tasks for which you have specifically granted rights and can gain access only to resources for which you have assigned permissions. By default, Windows Server 2003 adds local user accounts that you create on the computer to the Users group. When a member server or a computer running Windows XP Professional joins a domain, Windows Server 2003 adds the Domain MCITP certification Users predefined global group to this group.