PLEASE HELP! Active Dir/Admin Permissions

[Lemur]

Where do I begin?

Initially I had my computer with Win XP connected to the MC domain. I am granted rights to my pc. I was able to install software without ANY problems.

This weekend, I installed Win 7 Enterprise. First I installed my own local username (lemur) for installation purposes - with admin rights by default. So far, so good.

I added our domain (mc.uky.edu) and was able to login in with my univerity-wide username - mark1. And I successfully connected.

So I am logged in as mark1 on the MC domain.

My problem is installing new software. If I install, say, FF, I will be prompted "Do you want to allow the following program to make changes to this computer". It asks for an administrator password under the domain:mc.

When I enter the "mark1" and the password, it's not accepted.

NOW, if I enter my local computer address (this means I'm going OUTSIDE of the domain) and password, it's accepted.

This can't be right. Surely I should not be expected to do this, and it's cumbersome. Is there a way to prevent Win 7 from asking "Do you want to allow the following program to make changes to this computer"?

Again, this worked perfectly on XP without problem.

Thank you for your time, consideration and comments.

Lemur

 

[patwhatsthat]

Well, I'm sorry and I know it's kind of a pain, but that's exactly how it's suppose to behave. Domain users are not by default users with "elevated" permissions so there is a bunch of stuff they can't do and one of them is installing software. The prompt is simply the new UAC "User Account Control" which didn't exist in XP, but you should have still been denied access or prompted for a admin or power user password. My suggestion is to have the domain administrator add your specific domain user account to the local admins group, or just simply log on locally instead of onto the domain when you want to do something like install new software. Hope this helps.

 

[Lemur]

Oh... I have no control over the domain. I have to request permission to change anything. But please keep in mind all worked well under X?

 

[patwhatsthat]

Don't want to go back and fourth about whether it worked on your previous install of XP or not, I will simply say that if your XP computer was a member (computer joined to the domain) of a domain. Then your issues would be the same except for the prompting by the UAC feature which is new to Win7...of course you can turn off UAC in control panel, however as a simple domain user that hasn't been granted local admin rights on your local machine you are still going to get prompted for a username and password who has elevated privledges.

 

[Lemur]

Thanks. Well I'm gonna stand up for my "rights"! I have a ticket in. Let's see what they can do for me. Unless they say the don't support 7.

 

[patwhatsthat]

I'm sure they have a plan to address this, one of the domain admins can have it done it about a half dozen clicks, however be prepared to just be told to use your local login to do installation and maintenance and to use your domain login to access domain resources. As a domain user logged on to your local machine, you are going to have problems with everything from windows updates to defraggin your local drive so be prepared to get into the groove

 

[Jordus]

Are you sure you are logging in right? A lot of the Vista/7 prompt boxes require you to type in your domain credentials UPN or domain\username style.

Make sure that at the bottom of the UAC box it says "DOMAIN: MC" and not the name of the local computer.

Did you also make sure that your domain account isnt being taken back out of the local admin group by a restricted groups policy?

 

[Lemur]

Are you sure you are logging in right? A lot of the Vista/7 prompt boxes require you to type in your domain credentials UPN or domain\username style.

Make sure that at the bottom of the UAC box it says "DOMAIN: MC" and not the name of the local computer.

Did you also make sure that your domain account isnt being taken back out of the local admin group by a restricted groups policy?

Yep. I'm logged onto the domain, so that's not a problem.

I contact the powers that be and, hopefully, they will provide admin for local, all PCs on my OU, and my servers.

 

[Lemur]

So, while I am waiting for IT to provide rights, there is another PRESSING issue.
I'm currently logged on locally (not through domain).

I have unfortunately noticed when I'm logged onto the domain, my #2 core goes to 100% and brings my pc to a standstill. This is very painful. Fast processor and 8GB memory (this is my work pc). Again, everything is cool when not logged onto domain.

Any thoughts?

Gracias!

 

[patwhatsthat]

Look in task manager use show processes for all users button go to processes tab and click the heading CPU to sort and see what processes are making the demands on your computer. In your environment their maybe a lot of domain policies that are completing in the background. How long does the computer #2 processor stay at 100%

 

[Barman58]

What is the process that is taking all the processor? if it is explorer I would suspect it relates to some form of remote resource - if it is explorer check the address of any remote mapped shares, it may be a simple miss-spelling

 

[Lemur]

News Flash - IT indicated they will need to [FONT=&quot]upgrade the domain controllers to work with Windows 7. That would explain why it's so slow. It's a known issue and they're working on it.
[/FONT]

 

[Barman58]

Nice and refreshing to see an IT department that are actually prepared or at least aware and working on the issues