At IU, in Windows 2000 or XP Professional, how do I log into my workstation with administrative rights using my ADS domain account?

At IU, the University Information Security Office (UISO) strongly recommends against running your Windows computer while logged in as an administrator. Instead, you should normally run your Windows computer as a member of the Users Group, not as an administrator or a member of the Power Users Group. For more information, see In Windows, why should I avoid running my computer as an administrator? For tasks requiring administrative access, you can gain it quickly using the Windows Secondary Logon service. For more information, see What is the principle of least privilege?

Note: The instructions below assume that you have created an ADS domain account for your Windows 2000 or XP Professional computer at Indiana University. For more information, see At IU, in Windows Vista, XP Professional, or 2000, how do I configure my computer to connect to IU's Active Directory Services domain?

If for some reason you must log in with administrative rights using your ADS domain account, follow these steps to make your ADS domain account an administrator on your local computer:

Windows XP Professional

1. Log in as an administrator or as a user in the local Administrators group. From the Start menu, select either Control Panel, or Settings and then Control Panel.
   
   
2. Open User Accounts and then click Add.
   
   
3. To locate the account, click Browse, and select the account when you find it. If you know the account you want to add, enter the username, and enter ADS as the domain.
   
   
4. You will have the choice of granting Standard, Restricted, and Other permissions. Select Other, and then select Administrator from the drop-down list.
   
   
5. Click Finish. ADS accounts added in this manner will appear in the list of user accounts. Users in the list of user accounts will be able to log into your computer using their IU ADS username and password.

Windows 2000

1. Click Start. From the menu that appears, choose Settings and then Control Panel. Then click Users and Passwords.
   
   
2. Select Add... . This will open the Add New User dialog box.
   
   
3. In the "User name" field, type your username.
   
   
4. In the "Domain" field, type ADS (recommended) or IUB .
   
   
5. Once you have added your username and domain, click Next. Another Add New User dialog box will appear. Under "User access level", choose Other, and make sure that "Administrators" is displayed.
   
   
6. Click Finish. Your username should be listed alphabetically in the Users and Passwords window.
   
   
7. Click OK to close the Users and Passwords window.

Comments/Questions/Corrections