Full permission but no Sharing - 2

  • Thread starter Thread starter Sam
  • Start date Start date
S

Sam

Hi Everybody,
I have a windows 2003 active directory network, with windows 2000
workstations,
For some reason I need to let my user be administrator on their
computers(they are all
network users with administrator permisions on their computer) but I don't
want to let
them doing any of following if possible:
1. Don't let them make or change share directories.
2. Don't let them make or change Maped drives.
3. Don't let them Install new programs.

Thank you in advance - Sam
 
Ultimately you can not restrict a local administrator. If you were using
Windows XP Pro you could use Software Restriction Policies to prevent them
from installing/running unauthorized applications. For Windows 2000 you are
much more limited. You can populate the disallowed Windows Applications
setting in Group Policy user configuration/administrative templates/system
to include setup.exe, install.exe, and msiexec.exe which may help with those
users that are not overly curious. I don't know of a good way for your
requests 1 and 2 other than to use Group Policy to hide as much as possible
from the users. Of course a local administrator can always create a local
user account to logon to their computer to bypass domain/OU Group Policy
user configuration. --- Steve
 
Back
Top