4

When I add a new user to Windows (7 or Server 2k8) and I make it a member of the Administrators group, does it matter if I keep or remove the Users membership? Most of the time I remove the Users membership since it seems redundant, but does it matter?

1
  • 1
    It doesn't matter. As part of the Administrators' group, you can do anything on the machine anyway. If you really feel the need to remove the user from the Users group, then do so.
    – user3463
    Nov 14, 2010 at 4:30

1 Answer 1

7

It matters in so much as Deny privileges take precedence over Allow. If your Users have a Deny permissions on anything, their Administrator membership will not allow them access to the resource. You can test this on Users by creating a deny permission to list contents of a folder, you will get the following warning dialog:

---------------------------
Security
---------------------------
You are setting a deny permissions entry. Deny entries take precedence over allow entries. This means that if a user is a member of two groups, one that is allowed a permission and another that is denied the same permission, the user is denied that permission.

Do you want to continue?

---------------------------
Yes   No   
---------------------------

So unless you plan to NEVER assign a Deny to Users, remove Administrators from the Users group.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .