Consequences of a Windows user being in both the Administrators and Users group?

Question

When I add a new user to Windows (7 or Server 2k8) and I make it a member of the Administrators group, does it matter if I keep or remove the Users membership? Most of the time I remove the Users membership since it seems redundant, but does it matter?

Answer 1

It matters in so much as Deny privileges take precedence over Allow. If your Users have a Deny permissions on anything, their Administrator membership will not allow them access to the resource. You can test this on Users by creating a deny permission to list contents of a folder, you will get the following warning dialog:

---------------------------
Security
---------------------------
You are setting a deny permissions entry. Deny entries take precedence over allow entries. This means that if a user is a member of two groups, one that is allowed a permission and another that is denied the same permission, the user is denied that permission.

Do you want to continue?

---------------------------
Yes   No   
---------------------------

So unless you plan to NEVER assign a Deny to Users, remove Administrators from the Users group.