David Wang said:
I agree. But that is only because there is no category with lower privs.
Well, there are guests, but their local profiles seem to disappear all the
time... Wait a minute! Maybe that would keep them from saving stuff on the
desktop that should go somewhere in their home directory.
On my personal machines, I run as "User" and file
bugs/complain against products that require me to have more priviliges
(except on installation, which I temporarily use RUNAS to be Administrator
to install the app).
It should be surprizing how many apps are aware of the possibility of being
run on NTFS. Even if they just considered that part of the app needs to be
read-only, and the config files stored where the user has sufficient privs.
The nice thing about "Users" is that they are restricted from being able to
screw the machine up -- which sounds like exactly what you need. This "ACL
deletion" would have never happened if the employee was a User.
Ultimately, from an IT perspective, you have to decide whether you're going
to lock down the desktop to lower your support costs, or whether the
flexibility and capability of screwing up the desktop is a cost the company
is willing to bear.
A colleague once explained to a boss who demanded the highest "privileges"
available on their VMS system, simply because he was "the boss of all". My
friend managed to explain to him that these were not really "privileges",
but "responsibilities and obligations", and would require him to come in at
all hours to fix problems.
/Al
