User privilages settings

  • Thread starter Thread starter CadiKen
  • Start date Start date
C

CadiKen

Is there a way to give a user more privilages without giving them
administrator rights? I have a lot of users complaining about not having the
ability to run some programs and they want to be able to do more. We have a
policy against giving users administrator rights so this creates a problem.
Has anyone figured this one out?
 
Is there a way to give a user more privilages without giving them
administrator rights?
Yes.

I have a lot of users complaining about not having the
ability to run some programs and they want to be able to do more.
Click to expand...

Please be more specific. What is the problem with the programs?
We have a
policy against giving users administrator rights so this creates a problem.
Has anyone figured this one out?
Click to expand...

We do have several thousand users and have the same policy and are
able to keep the policy. Please describe your problems.

Take a look at the answers to news-id
[email protected]
first.

Ciao, Waltere
 
Greetings --

Certainly. You simply need to tailor the users permissions to
meet the needs of each specific application. Or replace these
applications with one that are properly designed to operate in a
secure environment.

Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH
 
Walter Schulz said:
Please be more specific. What is the problem with the programs?


We do have several thousand users and have the same policy and are
able to keep the policy. Please describe your problems.

Take a look at the answers to news-id
[email protected]
first.

Ciao, Waltere
Click to expand...

OK, I'll be more specific. For one, Photoshop 6.5 will not run unless the
user has administrator rights. It seems that it is trying to access the
registry or something and will not start. In some cases teachers cannot
install grade book software without being a member of the administrator's
group. If I placed these users in a group and created a group policy to add
that group into the local power user's group in the OU where the computers
are will that work? I'm unsure if the permissions granted this way will work
for what I need. I understand that in an Enterprise network you can easily
enforce such a policy but it is not so cut and dry when dealing with an
educational institution. Teachers cry that their teaching creativity is
being hampered when they cannot access their computers fully and not install
software on their own.
 
"CadiKen" <KCollins AT dcstechnologies DOT com> wrote in message
Sent: Saturday, October 11, 2003 05:47 PM
Is there a way to give a user more privilages without giving them
administrator rights? I have a lot of users complaining about not having the
ability to run some programs and they want to be able to do more. We have a
policy against giving users administrator rights so this creates a problem.
Has anyone figured this one out?
Click to expand...

Windows 2000 ships with a predefined incremental security templates named
compatws.inf (Compatibility Template) that can be applied to relax the default
permissions on files, folders and registry keys for the Users group. After applying
this template many legacy applications that do not comply with the Windows 2000
Application Specification are more likely to run. For some information, see the
following Microsoft Knowledge Base Article:

269259 - After Upgrade, Some Programs Do Not Run When You Are Logged
In as a Member of the Users Group
http://support.microsoft.com/search/preview.aspx?scid=kb;en-us;269259

And if permissions for the Users group are still too restrictive after applying
compatws.inf, try using the Sysinternals tools Filemon and Regmon to monitor access
(search Regmon for "ACCDENIED" and Filemon for "FAILURE"). Then relax permissions on
objects found in your search. For more information about Regmon and Filemon see:

Sysinternals Freeware - Information for Windows NT and Windows 2000
http://www.sysinternals.com/ntw2k/utilities.shtml
 
OK, I'll be more specific. For one, Photoshop 6.5 will not run unless the
user has administrator rights.
Click to expand...

In 7.x it will do to give change permissions to the Photoshop subdir
in %Programfiles%.
I understand that in an Enterprise network you can easily
enforce such a policy but it is not so cut and dry when dealing with an
educational institution. Teachers cry that their teaching creativity is
being hampered when they cannot access their computers fully and not install
software on their own.
Click to expand...

I could not say that enterprises are much different compared to
schools. Oh, sorry, you talked about teachers and not about pupils.

Teachers (in Germany) are using plans and fine tuned concepts to keep
their teaching stuff together. Otherwise they would run out of
schedule and leaving a terrible mess to the next teacher in charge.
Teaching creativity doesn't mean they are not able to cooperate with
IT department. They may use their tools and you may establish a
working environment for them without giving admin rights. We are using
about 160 software packages this way.
You may have to use repackaging tools to do this or you might use
imaging solutions. It's up to you.
It's not necessary to give admin rights.

Ciao, Walter
 
Back
Top