Optimizing Security w/ GPO

  • Thread starter Thread starter Preacher Man
  • Start date Start date
P

Preacher Man

We have a Win2K domain w/ XP workstations. I want to give computer users
the ability to change their settings and install software if needed. Right
now I add their domain account to the local administrators group to
accomplish this. I know this is an overkill. What would be the proper way
of doing this through a GPO from the domain? Any ideas?

Thanks,
Preacher Man
 
"Users" can change their own settings, but not "system" settings.

Unfortunately, to install most software you have to be an Administrator,
although some can be installed by Power Users, or in a few cases, Users. I
question to ask yourself is why do users need to install software? If you
allow this behaviour, you essentially loose control over the workstations;
you increase the probability of getting viruses, spyware, Trojan Horses
etc.; having conflicts between different software packages and in general,
increased support costs.

You can populate Local Groups using Computer Configuration, Windows
Settings, Security Settings, Restricted Groups in a GPO - see
http://support.microsoft.com/?id=810076.
 
Back
Top