Groups overview

Members of the Administrators group have full control over the computer. It is the only built-in group that is automatically granted every built-in right and ability in the system.

Members of the Backup Operators group can back up and restore files on the computer, regardless of any permissions that protect those files. They can also log onto the computer and shut it down, but they cannot change security settings.

Members of the Power Users group can create user accounts, but can modify and delete only those accounts they create. They can create local groups and remove users from local groups they have created.They can also remove users from the Power Users, Users, and Guests groups.

They cannot modify the Administrators or Backup Operators groups, nor can they take ownership of files, back up or restore directories, load or unload device drivers, or manage the security and auditing logs.

Members of the Users group can perform most common tasks, such as running applications, using local and network printers, and shutting down and locking the workstation. Users can create local groups, but can modify only the local groups that they created. Users cannot share directories or create local printers.

The Guests group allows occasional or one-time users to log on to a workstation's built-in Guest account and be granted limited abilities. Members of the Guests group can also shut down the system.

The Replicator group supports directory replication functions. The only member of the Replicator group should be a domain user account used to log on the Replicator services of the domain controller. Do not add the user accounts of actual users to this group.