"Jason" said:
Thanks for the info. However, my concern is having normal users in the
registry editors. IMO, normal users have no reason to be going into the
registry. If an administrator wishes to have access to it, it should prompt
for the Admin password like it does to run MSConfig.
As has already been pointed out by others, you can certainly deploy a policy
that prevents your users from having access to the registry editing tools, but
the users do actually have a need to access their own registry hives, so you
need to leave the registry ACLs on their own HKCU hive open to them.
And if they're allowed to change registry settings through other programs, are
you really achieving much by preventing them from directly editing the
registry? I can think of a couple of benefits of disabling their access to
regedit:
1. Stops people from downloading and installing .REG files that might
otherwise cause damage. Of course, that means that it also prevents them from
downloading and installing .REG files that come as part of their local
installation of a program...
2. Stops users from tinkering with things they do not understand. But then,
they'll tinker with other things they do not understand, anyway, so perhaps
you just have to come up with creative ways of persuading them to hold out
their hands for you to slap every time they do this.
Alun.
~~~~
[Please don't email posters, if a Usenet response is appropriate.]
