group policy for software developers

[Akhlaq Khan]

i want to implement a group policy for software development OU such that
they can be able to run all the applications which require access to
Registry etc. for example Visual Basic/Interdev editor through which they
can compile DLLs etc. Also i want them to be able to have most of the access
to diff. resources e.g administration of their local IIS (which they need to
work on occasionally) except for what i disallow.

Since the users created in AD users & computers are added to the "Users"
security group by default which does not have sufficient rights for software
development needs, i wanna know what can i do to achieve this objective ?

Thanks ...

regards,
Akhlaq Khan

 

[Kevin Mattson]

The best way would be to create a group for your developers. Then use
the restricted groups policy to add the developers group to the power
users group on the PC's. Computer Configuration-Windows Settings-
Security Settings-Restricted Groups

Kevin Mattson
www.deploy-tech.net

 

[Akhlaq Khan]

Thanks for the info Kevin ...

just need to know one more thing ... how can i add those users to the Power
Group ? i dont see any power group in the Domain controllers built-in
accounts. are you talking about the Power users group on their workstations
? if yes, how can i add those users (software developers) to the Power users
on group on their workstations through a group policy ?

Thanks ...

regards
akhlaq khan

 

[Kevin Mattson]

Akhlaq

The GPO will be adding the users to the Power Users group on their
workstations. First run dsa.msc as a domain admin from a workstation.
Go to Computer Configuration-Windows Settings-Security Settings-
Restricted Groups. From there you will add Power Users as the
restricted group and will add the software developer group as a member
of the Power Users group (You will first need to create the sofware
developers global security group and add individual members to that
group). Then once their workstations are restarted, they will be Power
Users which should provide sufficient rights for them.

Kevin Mattson
www.deploy-tech.net

 

[Akhlaq Khan]

Hello Kevin ...

when i ran dsa.msc on one of the worstations ... it said "cannot find the
file dsa.msc (or one of its components) ...." my workstations are plane
win2k pro (without any service pack) ... do i need to install a service pack
first ?

thanks ...

akhlaq.

 

[Akhlaq Khan]

kevein .... i even tried on a workstation with win2k pro SP4 .... still same
result