For logon Scripts, take a look at ScriptStart ( There OpenSource (free) program allow you to manage everything from printers to drives at login. 

I don't think it works for nt4, but you can manage the local groups from the domain policy:;en-us;320065 

Bjorn Behrendt 
Proctor School District 
[log in to unmask] 

----- Original Message ----- 
From: "Craig Lyndes @" <[log in to unmask]> 
To: [log in to unmask] 
Sent: Thursday, March 20, 2008 12:15:46 PM GMT -05:00 US/Canada Eastern 
Subject: Re: Tech Question, Local restrictions with a Domain login 

Dear Folks, 

David (and Ray who replied directly to me) gave me the key! Adding a 
domain group (other than Domain Admin which seems to be added 
automatically) to the local Administrator group does it! 

Thank you! Thank you! Thank you!!! 

I will now create a Domain PU (Power Users) group and add people to that 
who are comfortable installing software, and make the change to the local 
Administrator group to the machines we wish to have people be able to 
install on. All images from this day on will have the Domain PU group as 
a part of the local Administrator group. 

Speaking of groups, what a great group this is!!! 

Now - any hints for creating login scripts for both Win98 and W2K, XP 
machines? Can you do an If Member of Group with this primitive M$ 
operating system? 

Craig Lyndes 
Franklin Central SU 

> Log as an admin of the workstation, not the domain. 
> Or add a domain user to the admin group on the workstation. 
> David Isham 
> Network Administrator 
> Grand Isle Supervisory Union 
> 5038 US Rte 2 
> North Hero, VT 05474 
> 802-372-6921 vox 
> 802-372-4898 fax 
> -----Original Message----- 
> From: School Information Technology Discussion 
> [mailto:[log in to unmask]] On Behalf Of Craig Lyndes @ 
> Sent: Thursday, March 20, 2008 11:39 AM 
> To: [log in to unmask] 
> Subject: Tech Question, Local restrictions with a Domain login 
> Dear Folks, 
> I have enherited a school that is using a Windows NT4 server as their 
> domain controller (yes, sharpen your memory for this one!). Whenever a 
> user logs into the domain they are restricted from installing programs 
> on 
> their local computer. Only Administrators can install software locally 
> when logged into the domain. 
> There are NO POLICIES on this domain, not a single *.pol file anywhere 
> on 
> the server (much less in the netshare). 
> I would like to create a group of users who are able to install programs 
> locally without giving them access to any network resources that they 
> normally wouldn't have access to. 
> Where is this restriction???? I've searched and searched for some 
> setting 
> that would restrict the ability to install progrms locally that is 
> coming 
> from the directory. At one point I guessed it was a default profile on 
> the workstation, but I've done a fresh install with no restrictions on 
> the 
> default profile. As soon as I add the computer to the domain and log in 
> as a domain user who isn't in the Administrator group - do not pass go, 
> do 
> not install software locally! 
> Thanks in advance for any hints as to where to look next. 
> Sincerely 
> Craig Lyndes 
> Franklin Central SU