Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to restrict some users from having default privileges of Users group, unless they are manually allowed. Unfortunately, when I remove them from this group manually, they still get Users SID as seen in WHOAMI /ALL: Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545

I don't want to change ACLs, because this action should be part of my program installation, and I don't want my program to change default ACLs across all drives to function.

share|improve this question
    
I don't believe a User can't be in a group. So I would simply create a group based on the User group and simply change the user's group when you want to give access to those privileges in question. –  Ramhound Aug 1 '13 at 11:35
    
I put new users into their own group, but they still get BUILTIN\Users SID. What do you mean by "create group based on the Users"? –  LOST Aug 1 '13 at 19:35
    
It means exactly what I said. Create a new user group with the exact permissions you want. When you want grant permissions to the exception change the user group of those users. –  Ramhound Aug 1 '13 at 19:50
    
The problem is even if I assign users to group Bla, they will have also permissions granted to BUILTIN\Users, which I don't want –  LOST Aug 2 '13 at 0:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.