Local rights set via GPO?

[Eric]

First of all, forgive my ignorance if this is something
fairly simple and/or routine.

We're trying to figure out how to give each user Power
User rights (or at least rights to register dll's) on
their local machines without having to visit each machine
individually and doing it manually. Ideally, this would
be done with GPO's, but we've yet to figure out how to do
so.

Some software we run registers dll's every time it's
launched as a way to check for updated versions of the
files. As far as I know, this can't be done without
Power User rights, or above.

Any thoughts and/or suggestions would be appreciated.

 

[Guest]

You can try adding a policy to allow users to load/unload device drivers,
Its located in the Computer Config\windows settings\security settings\local
policies\user rights assignment

The policy would need to be linked to a container that held all the computer
accounts you wanted this to apply to.

Give that a try and see if it allows the permissions the app is looking for.

 

[Eric]

Thanks for the suggestion. I tried what you mentioned,
but without success. Anybody else have suggestions?

-----Original Message-----
You can try adding a policy to allow users to load/unload device drivers,
Its located in the Computer Config\windows

settings\security settings\local

policies\user rights assignment

The policy would need to be linked to a container that held all the computer
accounts you wanted this to apply to.

Give that a try and see if it allows the permissions the app is looking for.

--
James Brandt [MSFT]

First of all, forgive my ignorance if this is something
fairly simple and/or routine.

We're trying to figure out how to give each user Power
User rights (or at least rights to register dll's) on
their local machines without having to visit each machine
individually and doing it manually. Ideally, this would
be done with GPO's, but we've yet to figure out how to do
so.

Some software we run registers dll's every time it's
launched as a way to check for updated versions of the
files. As far as I know, this can't be done without
Power User rights, or above.

Any thoughts and/or suggestions would be appreciated.

.

 

[Gary Mudgett [MSFT]]

Hi Eric,

If you know the keys that the DLLs register to you could give the set
permissions on the keys in the registry by setting up a GPO to set those
permissions. This policy would need to apply to the computers.

Computer Configuration\Windows Settings\Security Settings\Registry

Other options could be a startup script that is run when the computer boots
to set the registry permissions using subinacl or regini from the resource
kit.

--
Gary Mudgett, MCSE, MCSA
Windows 2000/2003 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Thanks for the suggestion. I tried what you mentioned,
but without success. Anybody else have suggestions?

-----Original Message-----
You can try adding a policy to allow users to load/unload device drivers,
Its located in the Computer Config\windows

settings\security settings\local

policies\user rights assignment

The policy would need to be linked to a container that held all the computer
accounts you wanted this to apply to.

Give that a try and see if it allows the permissions the app is looking for.

--
James Brandt [MSFT]

First of all, forgive my ignorance if this is something
fairly simple and/or routine.

We're trying to figure out how to give each user Power
User rights (or at least rights to register dll's) on
their local machines without having to visit each machine
individually and doing it manually. Ideally, this would
be done with GPO's, but we've yet to figure out how to do
so.

Some software we run registers dll's every time it's
launched as a way to check for updated versions of the
files. As far as I know, this can't be done without
Power User rights, or above.

Any thoughts and/or suggestions would be appreciated.

.