HOW TO: Set User Rights in Windows 2000

This article describes how to set user rights in Windows 2000.

Setting User Rights in Windows 2000

1. Click Start, point to Settings, and then click Control Panel.
2. Double-click Administrative Tools, and then double-click Local Security Policy.
3. Double-click Security Settings, double-click Local Policies, and then double-click User Rights Assignment.
4. Double-click the user right you want to change.
5. Click Add, and then click the accounts to which you want to assign the right.
6. Click OK, and then click OK again.
7. To confirm the changes have taken effect locally, close the Local Security Policy window and then open it. The newly assigned rights should show under the Effective Settings column.
   
   If the rights are not being assigned locally, check to see what Group Policy objects are being applied through Active Directory, and if those Group Policy objects have settings that are in conflict with the local settings.

To access the Domain and OU level, open Active Directory Users and Computers from the Administrative Tools.

To modify the OU or Domain level user rights from within Active Directory Users and Computers, select the OU or Domain that contains the objects (computers) to which you want that user right assigned. Right-click the OU or Domain, and then click Properties. Click the Group Policy tab, and then double-click the Policy name in the Group Policy Object Links. If none exist, click New, and then double-click the newly added policy. From the Computer Configuration, Windows Settings, Security Settings, Local Policies select User Rights Assignment. Double click the user right that needs to be set. Check the box next to Define these policy settings. Click Add. Type name or browse to select the user or group needing this user right. Click OK three times.

Note: Containers don't allow you to grant group policies. The default Computers is a container so if you need to grant policies to the computers that are not DCs at the OU level, you must create a new OU and move those computers to the new OU.