Hi there, I'm a rookie to the whole Server 2003 / Small Business Server 2003 deal. What I'm trying to do is restrict network users by making them local "Users" and then specifying which folders they should have read/write/execute privileges for on their local desktop. For instance, we have a couple computers that are used by several people, and require read/write/execute permissions to use a couple applications that we have installed. However, when I trying to add "Users" to the permissions, it doesn't grant access to all users. Instead, I'm forced to specifically enter each person's name who will need access to the folders. This becomes a chore. I'd like to be able to just add a single user group that allows anyone on the network to have the proper permissions for the given files/folders. How can I create a user group on Server 2003? Or, how can I make sure the group "Users" includes all network users? Thanks!

Do you have a Domain setup? Life's more painless for the brainless.

Yes, we have a domain setup. Right now, it's just the SBS03 server with about 15 workstations that a consultant set up for us, but beyond the basic setup, it hasn't really been customized in any ways. The only groups I know of are the standard groups. But when I got to Mycomputer > Manage and add a worker as a local "user" and then grant the group "Users" read/write/execute permissions on a certain file/folder, it doesn't seem to include anyone on the network. I'm not sure if the User group needs to be setup on the server?.... Anyways, sorry for the ramble, yes, a domain has been setup.

You need a little help with your terminology. By "network" you mean Domain. If you want Domain Users to have access to certain files/folders, set the permissions for that Group. You don't want to assign local accounts, as the users are not authenticating locally. They're authenticating to the Domain. All users should have Domain accounts, and will, therefore, be members of the Domain Users Group. Life's more painless for the brainless.

Ok, I think I've already done what you are saying. Let me describe the process to I know where on the same track (pardon my lack of proper terminology, btw). To start, we had a Macintosh network here consisting of a OSX Server and like 20 workstations. We are slowly converting over to PC though (not sure why we had Macs to begin with). Anyways, here's what I do: From the default install of SBS03, we added all necessary users and computers in the server management console. Then from each workstation, we join the domain by opening a browser and going to [servername]/connectcomputer. Once the computer has joined the domain, I right click on my computer > manage and add users who will likely be using the given workstation, usually only one or two. However, there are a few computers here that get used by many people. On these community computers, I need to allow users to have read/write/execute permissions on a couple folders in C:\Program Files. For whatever reason, when I set the permissions on the folders to allow "Users" the correct permissions, it doesn't include the local users that I've added. Consequently, I am forced to manually specify which users can have access to read/write/execute, instead of simply adding a group. Does this make any more sense at all? Sorry, I'm sorta new to all this stuff, but very eager to learn! Thanks!

Typing in a servername and share is not joining a Domain. You don't say which OS your clients are running, but you need to actually join the computer to the Domain. THEN, the Domain users can authenticate to the Domain. So, if you're using Widows 2K, Right-click My Computer, Properties, Network Identification, Properties. And, under the "Domain" option, click the Radio Button and type in the name of the Domain. Then, you will need to authenticate with your domain admin account in order to finish adding that client to the Domain. After a reboot, on the newly created third line of the authentication window, you will change the authentication from xxxxx(This Computer) to the Domain. "Once the computer has joined the domain, I right click on my computer > manage and add users who will likely be using the given workstation, usually only one or two" So you're adding local accounts, which means those users will be authenticating locally, not to the Domain. If you add the client machines to the Domain, all Domain users will be able to login to the computer with his/her Domain Account. It's not necessary to create local users. After the machine has been added to the Domain, then set the permissions. However, default permissions should allow users to execute any of the Programs, unless of course the permissions were messed up to begin with. I would definitely recommend you purchase a book on Domain Administration for Server 2003. :) Life's more painless for the brainless.

The workstations are XP Pro. All the users are already joined to the domain. Under network ID (My Computer > Properties > Computer Name) it shows our server as the domain name (QSBS.local). The "[ServerName]/connectcomputer" command within Internet Explorer is a utility that adds computers to the domain. Our network was setup by a consultant who definitely knows his stuff and showed me everything I need to know to join workstations to the domain. However, he is very difficult to get in touch with since he works for much larger companies that have forced us into low priority. Unless I'm missing something, I'm 99% certain all the workstations within the company are authenticating to the server. That said, the default user permissions DO allow you to use software. The problem is that we use a couple legacy applications that have local databases stored under C:\. Therefore, the directory that the reside needs to have read/write/execute privileges. I want to be able to make it so that ALL domain users can read/write/execute folders/files that I specify, without having to manually type every single user who will be using the given workstation. Does this help clarify my situation at all? PS - I do have a book: SBS03 Unleashed. It's a good book but I don't know all the proper nomenclature so that might be why I can't find my answer, perhaps.