This article describes some of the default security settings in Windows 2000. Such users have read access to most parts of the system and write access only under their own profile folders. Such users have write access to parts of the system besides their own profile folders. This enables them to install programs, and more.
Administrators have all the access they have always had.
Users do not have broad write access to the system. Such users have read access to most parts of the system and write access only under their own profile folders. Such users can only access domain controllers over the network. Local logon to domain controllers is denied. Server Operators, Account Operators, and other built-in groups have the same access as in Windows NT 4.0 and earlier.