Re: Advice wanted on setting user permissions - Group policy etc

"eggedd2k" <> wrote in message news:146da741-4223-4f80-a780-...
> I'm just in the process of setting up a couple of shiny new Dell
> servers for our organisation. They're going to be replacing our
> existing Windows 2000 Server infrastructure.
>
> I want to get permissions for users correct from the start.
>
>
> Basically I want to achieve the following:
>
> - Users can run all of our core business apps
> - Users cannot install any software (i.e. downloading and installing
> apps etc)
> - Users cannot access their C: drive (for obvious reasons)
> - Users cannot access display properties (basically no custom
> wallpaper/screensavers)
>
>
> Locking down the C: drive etc I already have in place via Group Policy
> but with regards to allowing users to run core business apps without
> giving them permissions to install software I would like some advice
> on.
>
> Am I right in saying users need to be in the Power Users group?
> Presumably anything higher than this is more than a users should be
> able to do?
>
> thanks in advance


I don't think that Power Users will do the trick. That may give them a bit more than you are planning. I would look at the applications in use, which folders they are installed in, changes it makes while the app is in use, as well as possibly registry locations that they app may or may not be making changes in, and apply Modify (not FC) to those folders and registry settings for the app. To determine which registry settings are being changed, you can use something like ART (Adv Reg Tracer), to see what changes are being made.

It's a little involved with a GPO, but it's totally possible. I have one client that I restrict everything. For their apps, which in this case their apps don't require registry mods, I simply give them Modfiy on the apps' folders, and they're good to go. They can't install anything, no ActiveX objects, nor can they access C: drive.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.

Please reply back to the newsgroup/forum to benefit from collaboration among responding engineers, as well as to help others benefit from your resolution.

Ace Fekay, MCT, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging
Microsoft Certified Trainer

http://twitter.com/acefekay

For urgent issues, you may want to contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.