installation rights

  • Thread starter Thread starter ali paracha
  • Start date Start date
A

ali paracha

Dear
I have implemneted domain controller in 2000.Now i
have some restricted users but problem is that i want some
users to give installation right but nothing more.Infact
this time i make them a domain admin group member which is
not good for domain security

Now plz tell me right policy to implemnet in group policy
so that they should have only installation rights.
Thanx
 
Hi, You can give them local administrator rights to there own box. Modify
Security for the %ProgramFiles% Folder. or use the policy belov to give them
access to install MSI Packages.


Always install with elevated privileges
User Configuration\Administrative Templates\Windows Components\Windows
Installer

Directs Windows Installer to use system permissions when it installs any
program on the system.

This policy extends elevated privileges to all programs. These privileges
are usually reserved for programs that have been assigned to the user
(offered on the desktop), assigned to the computer (installed
automatically), or made available in Add/Remove Programs in Control Panel.
This policy lets users install programs that require access to directories
that the user might not have permission to view or change, including
directories on highly restricted computers.

If you disable this policy or do not configure it, the system applies the
current user's permissions when it installs programs that a system
administrator does not distribute or offer.

Caution

Skilled users can take advantage of the permissions this policy grants to
change their privileges and gain permanent access to restricted files and
folders. Note that the User Configuration version of this policy is not
guaranteed to be secure.

!!Important!!

This policy appears both in the Computer Configuration and User
Configuration folders. To make this policy effective, you must enable the
policy in both folders.



--
Regards,

Christoffer Andersson
No email replies please - reply in the newsgroup
If the information was help full, you can let me know at:
http://www.itsystem.se/employers.asp?ID=1
 
Back
Top