Optimizing Security w/ GPO

[Preacher Man]

We have a Win2K domain w/ XP workstations. I want to give computer users
the ability to change their settings and install software if needed. Right
now I add their domain account to the local administrators group to
accomplish this. I know this is an overkill. What would be the proper way
of doing this through a GPO from the domain? Any ideas?

Thanks,
Preacher Man

 

[Bruce Sanderson]

"Users" can change their own settings, but not "system" settings.

Unfortunately, to install most software you have to be an Administrator,
although some can be installed by Power Users, or in a few cases, Users. I
question to ask yourself is why do users need to install software? If you
allow this behaviour, you essentially loose control over the workstations;
you increase the probability of getting viruses, spyware, Trojan Horses
etc.; having conflicts between different software packages and in general,
increased support costs.

You can populate Local Groups using Computer Configuration, Windows
Settings, Security Settings, Restricted Groups in a GPO - see
http://support.microsoft.com/?id=810076.