Windows 98 client on Server 2000

Our windows 98 clients have free roam of even the domain controlers. It seems as if they have administrator rights though they have not been given that.

I dont see any options for configuring the user on the client machine. What is the best way to limit windows 98 client on a w2k server.

Thanks for your response

A 98 client has the same rights as a NT/W2K/XP/ME/Dos client and those are THE ONES YOU ASSIGN WHEN YOU CREATE A SHARE ON THE SERVER.

Your question is about proper group management/user management/ access to shares and network resources. You configure this at the server never a workstation.

So decide what users need access to what network/server resources. Create groups built upon this information. Assign users to these groups. Assign groups to the shares. Share only specific folders and never the root of the server.

The fine points are covered in any good OS admin book. Best of luck!

wanderer2

thanks for your reply. The initial set up of the Windows 98 machines was done by some third party people. I dont know what they did.

Here is what I did.

I renamed the client machine. Created a computer account for the machine, created a user within the specific group. When this user logs in on the Windows98 machine (only) he has full access to every folder on the domain controlers. This only happens when logging in on W98 machine.

I dont find anything in my books that cover this. Anybody have any ideas

Only ntldr based OS's [nt/w2k/xp] require a machine account on the server. 98 does not need or use a machine account.

Please do the following:

Create a new user account on the server and 98 workstation. Same name and password on both.

Do not assign to any groups.

Logon from a 98 box. Do you see all folders on the server? Can you access said folders?

You say the logged in 98 user appears to be admin equal, can you create and delete files? Access all folders with no access denied messages?

What we need to find out here is do they really have admin access? Is this access by group membership or file level access or both? This is all server based. A client should only see what is shared. It appears to me that you have the root and by default all subfolders shared on the DC's. Please look at your shares and how they are configured.