Windows 2000 Administrative Groups

Windows 2000 and Active Directory provide groups already configured into the product. They are located in two folders: the Builtin folder and the Users folder.

Builtin Folder Groups

In the builtin folder, Windows 2000 provides built-in administrative groups. These groups are used to control the management or use of the Windows 2000 environment. The Windows 2000 environment provides the following administrative groups.

The account operators group members are able to administer domain user and group accounts. This is typically used to add and delete users, create and modify group accounts, and change passwords.

The administrators group members have full administrative capabilities in the domain. The members of this group can perform any administrative function in the domain.

Members of the backup operators group are restricted to running the backup program. The members of the backup operators group are able to backup files and folders.

The guest and users group members have the ability to use the computer they are logged into and to save documents, but these members are not able to install programs or make changes to the systems. The guest group is typically used for access to specific resources.

Members of the print operators group have privileges for administering printers within the domain. They have the ability to purge print queues and to set priorities for print jobs.

The server operators group members have the rights to administer domain servers.

User Folder

In the Users folder, there are several predefined groups. These groups include the Domain Admins, Domain Computers, Domain Guests, Domain Users, Enterprise Admins, Group Policy Admins, Schema Admins, and Cert Publishers. Each of these groups provides for users with specific access to resources in the domain or enterprise.

The domain users have specific user rights within the domain. Enterprise Admins have administrative rights within the enterprise.