We run an app. on our Terminal Server that requires Users
to have rights to modify the registry. From client
machines in our office, it's no problem since all our
Users are setup as Administrators of their machine.

However, our terminal server is a domain controller and we
certainly don't want to give Users admin. rights to the
domain. Even if we demote to member server, we still
wouldn't want to give Users admin. rights to a server.

Thanks for any ideas/solutions!
Bob

What part of the registry must the user access? From regedit.exe, you
can right click on a key and select 'Permisions...' to use UI to set
the permisions for a specific branch of the registry. An obvious
caveat is to be really sure you really want to give access to the
registry to users and to consider what possible negative consequences
could happen if the user modifies or deletes the keys.

On Fri, 16 Jan 2004 13:11:16 -0800, "Bob"
<(E-Mail Removed)> wrote:

>We run an app. on our Terminal Server that requires Users
>to have rights to modify the registry. From client
>machines in our office, it's no problem since all our
>Users are setup as Administrators of their machine.
>
>However, our terminal server is a domain controller and we
>certainly don't want to give Users admin. rights to the
>domain. Even if we demote to member server, we still
>wouldn't want to give Users admin. rights to a server.
>
>Thanks for any ideas/solutions!
>Bob

This posting is provided "AS IS" with no warranties, and confers no rights

Aside from recommending that you don't run TS on a Domain Controller (unless you have no choice) I'd recommend that you run regmon from sysinternals.com to identify the exact registry key that your program is requesting access to write to and make the appropriate change in that key's ACL.

Patrick Rouse
Microsoft MVP - Terminal Server
http://www.patrickrouse.com/ts.htm