Allowed home directories using runas command

[Guest]

Hi there,

Is there any way I can allow standard user account users with restricted
access to logo to an Windows XP Pro PC on a Win 2003 domain and run a program
using runas credentials for an enhanced permissions users account to execute
a program but still get access to their home directory whilst logged in under
the enhanced users credentials.

Any advice appreciated.

Regards,

Tony

 

[Pegasus \(MVP\)]

Hi there,

Is there any way I can allow standard user account users with restricted
access to logo to an Windows XP Pro PC on a Win 2003 domain and run a program
using runas credentials for an enhanced permissions users account to execute
a program but still get access to their home directory whilst logged in under
the enhanced users credentials.

Any advice appreciated.

Regards,

Tony

Sure - simply include the enhanced user account in the
permission structure for the user's home directory.

 

[Guest]

Hi Pegasus,

Thanks for your response.

Yea we had though of that BUT because a lot of our users will be using this
runas command and the enhanced account to run software this opens up the
possibility of allowing any user that has been granted permissions to the
apps user to be able to hack into other users accounts i.e. by mapping or
UNCing into their accounts thus negating our NTFS permissions on the accounts
so that only the owner of the account and the administrators can access their
account’s home directory.

Is there any other way to achieve what I require, that is once a user login
in as their standard user account and uses the runas command to execute
software they have their home directories automatically mapped.

Thanks in anticipation,

Tony

 

[Pegasus \(MVP\)]

You write "...i.e. by mapping or UNCing into their accounts
thus negating our NTFS permissions...". There appears to be
a misconception here. Mapping a share, whatever means you
use, does NOT get around NTFS permissions.

A better solution might be to create a local group that has
sufficient privileges to execute your application yet insufficient
priviliges to access users' home folders. You then make all
domain users members of this local group.