NO!!!! Do not maker users domain admins!! They can be LOCAL admins of their LOCAL PC's, but they should NOT be admins!!
I learned a great phrase a long time ago on how to deal with users, groups, and resources. Although 2K's security and group structure is slightly different than NT, the concept remains the same.
The phrase is UGLieR
USERS into Global groups;
GLOBAL groups into LOCAL groups;
LOCAL groups control the RESOURCE
In other words, making domain users members of Global groups, allows YOU the control of what they can do, and makes the administration of those resources, even on the local level, controllable globally.
Case in point: If you want users to be able to be local admins so they can install software etc. on their own pC's, then make the GLOBAL Domain users group members of the LOCAL pc's administrator's group. This administrative priviledge only allows LOCAL changes, and not Domain changes.
But even this may be too widespread, sonce everyone is a Domain User by default. So, you can create a new global group called let's say, "Approved Users". Now, select whatever domain users you want to belong to this Global group, and assign THIS global group LOCAL admin priviledges, instead of domain users. So now, unless you've been added to this global group (ie: a regular domain user.... your kids for instance) you will be unable to effect changes to the local PC.
Cool, huh?
