sorry u misunderstood me. incase of windows ad, incase of any change in user/group requirements akk the sysadmin needs to do is to make a change to group /user policies at the AD server. here you will need to change/edit the file at the user end.