Need to setup a "safe" account?

[***** charles]

Hi all,

I need to setup an account that can read and execute
all of the installed programs in XP Pro but can not
modify or "hurt" the system with installs. The
regular "user" account can not execute non-certified
MS programs and the poweruser account has the
ability to do installs which I don't want for this
account. Can I setup a custom group that has the
characteristics I seek and put this account in it?
Example of one problem: user account can not run
OpenOffice after installed by another account that
has higher privileges like administrator This is on
a standalone machine.

any ideas?
charles

 

[Kent W. England [MVP]]

I need to setup an account that can read and execute
all of the installed programs in XP Pro but can not
modify or "hurt" the system with installs. The
regular "user" account can not execute non-certified
MS programs and the poweruser account has the
ability to do installs which I don't want for this
account. Can I setup a custom group that has the
characteristics I seek and put this account in it?
Example of one problem: user account can not run
OpenOffice after installed by another account that
has higher privileges like administrator This is on
a standalone machine.

It is easier to grant modify privileges to the Users group on the
application's Program Files folder and possibly the software keys for
that vendor/app in HKLM in the registry. Some really old apps also place
user-writeable files in %windir%, so success varies. You can sometimes
find advice on the vendor web site about making the application work
with limited accounts, which lists all the permission settings that have
to be set to "modify" for limited users.

 

[***** charles]

It is easier to grant modify privileges to the Users group on the
application's Program Files folder and possibly the software keys for
that vendor/app in HKLM in the registry. Some really old apps also place
user-writeable files in %windir%, so success varies. You can sometimes
find advice on the vendor web site about making the application work
with limited accounts, which lists all the permission settings that have
to be set to "modify" for limited users.

I would assume that this could be a big headache for businesses that
use Windows OS on the computer and other companies' software
that isn't certified. How do companies in general protect computers
from their users who want to add software that may be detrimental?

thanks,
charles.....

 

[Kent W. England [MVP]]

I would assume that this could be a big headache for businesses that
use Windows OS on the computer and other companies' software that
isn't certified. How do companies in general protect computers from
their users who want to add software that may be detrimental?

As you said, Power Users can install software and Users cannot. You can
roll out an application and include a set of cacls commands in a batch
file to change permissions for Users group.

Domain setups also have the power of Group Policy keys to manage Windows
and Office.