User Permissions

[Sue]

I have a domain with apprx. 20 workstations connected to it running win2k
w/sp4. I would like to setup each user to have permissions to install
applications and hardware and critical updates as they become available. I
do not, however, want them to be able to make registry changes or to access
other workstation's drives on the network.

Right now I set up all new users as a power user but that is not enough
rights to install updates, new hardware or applications.

I had read that making a user an Administrator of their local computer would
do what I want, but I tried that and if the users are logged into the
domain, they still have limited rights. Is there a way that I can get more
rights than 'power user' to the users but less than full administrative
rights while they are logged into the domain?

Thanks,
Sue

 

[Danny Sanders]

I had read that making a user an Administrator of their local computer
would

do what I want, but I tried that and if the users are logged into the
domain, they still have limited rights.

Add their domain account to the local admin group. Then when they log into
the domain they will have admin privileges on the local computer.

hth
DDS W 2k MVP MCSE

 

[Ryan Ondrey]

I'm going to have to go against Danny and suggest giving them local admin
privleges and creating a group policy on the OU the users are in that will
lock them out of editing the registry (you can lock them out of "run" all
together and quite a few other things too, pretty handy). You need to keep
them from accesing it rather than locking them out of it, if you lock them
out then when they install stuff under they're login the install won't
happen (i don't think) so if you keep them from being able to edit it
directly the system can still make changes when installing or updating.

Ryan Ondrey
MCSA, E & DBA, A+, NET+