0

I want to restrict some users from having default privileges of Users group, unless they are manually allowed. Unfortunately, when I remove them from this group manually, they still get Users SID as seen in WHOAMI /ALL: Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545

I don't want to change ACLs, because this action should be part of my program installation, and I don't want my program to change default ACLs across all drives to function.

4
  • I don't believe a User can't be in a group. So I would simply create a group based on the User group and simply change the user's group when you want to give access to those privileges in question.
    – Ramhound
    Aug 1, 2013 at 11:35
  • I put new users into their own group, but they still get BUILTIN\Users SID. What do you mean by "create group based on the Users"?
    – LOST
    Aug 1, 2013 at 19:35
  • It means exactly what I said. Create a new user group with the exact permissions you want. When you want grant permissions to the exception change the user group of those users.
    – Ramhound
    Aug 1, 2013 at 19:50
  • The problem is even if I assign users to group Bla, they will have also permissions granted to BUILTIN\Users, which I don't want
    – LOST
    Aug 2, 2013 at 0:50

0

You must log in to answer this question.

Browse other questions tagged .