Windows 2008 Group Policy Setting? - Migration Headache

I have a small domain of users that I just migrated from a linux domain running open-ldap. Our new servers are running Windows 2008 Standard. I've installed Active Directory and everything is working perfectly... except that the initial user privileges is pretty restrictive and I need to loosen it up a bit. For example once they login to their workstations, they can create new files and folders but can not modify existing files or start. I basically want to open it all up except for software installations.

Can someone please help with with this migration headache?

From serverfault DevNULL

• Are the users in the domain just standard users on their PC's (not local administrators)? What OS are the clients running? What existing files are they not able to modify? What error message do they get?

  From Sean Earp

• If they can't modify existing files then in the root of the problem files folder, select Folder Properties, Security, Advanced, confirm Local Users has FULL, check the box "Replace existing inherited permissions and apply inherited permissions from here", Apply. This will remove/fix any NTFS permission problems, assuming the parent folder has correct permissions.

  Above are general steps because you don't specify the client OS. Vista/Win7 don't allow Local Users write access to many folders, Program Files, so above is meant for user profile folders only.

  You can restrict software installations w/ Group Policy.

  DevNULL : I've migrated from linux to Win2k8 standard. All the developers (domain users) are running XP SP3 and of course have full control over their machines, until I add them to the domain. Once they are using their AD logins, they are greatly restricted. I've setup the domain server strictly as DNS, WINS and AD and soon will integrate WSUS. I was a little unclear. Are you saying that the file permission problem is local to the users machine or the servers GP policy? The files they are having trouble saving / modifying are stored on their machines, not the server BTW: Thanks for your help

  Ed Fries : Yes, if the files that can't be modified are on the workstations then the permissions must be fixed on each workstation. The Default Domain GP does not restrict access like you are seeing, that isn't the problem unless you've made changes to it. Adding the Domain Account to the Local Admin Group on the wkstn can also open up things like letting users change/add printers but won't fix access to files in their domain user profile. If this doesn't fix it then post the exact error and the NTFS permissions for the file/folder.

  DevNULL : Here's a little more information... They can only save documents within their user folders. If a user tries to save anything in the root, system etc... directories access is denied. I logged in and gave full control to everyone within that group and still getting access errors. Any ideas. I'm sure the problem lies on the server side.

  Ed Fries : My ideas are the same as previously: set the NTFS permissions as needed (I understand you tried but if the problem remains then they aren't correct), add the Domain User to the local Admin Group, or edit your question to show the current NTFS permissions so we can see them. Changing permissions on root and system aren't recommended so placing them in the local Admin Group is the easiest solution. Understand that opens it up for them to change essentially anything.
  From Ed Fries