Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to restrict some users from having default privileges of Users group, unless they are manually allowed. Unfortunately, when I remove them from this group manually, they still get Users SID as seen in WHOAMI /ALL: Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545

I don't want to change ACLs, because this action should be part of my program installation, and I don't want my program to change default ACLs across all drives to function.

share|improve this question
I don't believe a User can't be in a group. So I would simply create a group based on the User group and simply change the user's group when you want to give access to those privileges in question. – Ramhound Aug 1 '13 at 11:35
I put new users into their own group, but they still get BUILTIN\Users SID. What do you mean by "create group based on the Users"? – LOST Aug 1 '13 at 19:35
It means exactly what I said. Create a new user group with the exact permissions you want. When you want grant permissions to the exception change the user group of those users. – Ramhound Aug 1 '13 at 19:50
The problem is even if I assign users to group Bla, they will have also permissions granted to BUILTIN\Users, which I don't want – LOST Aug 2 '13 at 0:50

You must log in to answer this question.

Browse other questions tagged .