Need Help setting Security Permissions for a new group...HLP!!

[Guest]

Hi.

Setting up a new local domain group on our W2k Server. I'd like the log in
users to do everything on the PC, EXCEPT Install programs, and search network
shares. I just need to lock down those two settings for the group policy.

I started to set it up yesterday, but the options are endless, both a
blessing and curse for Windows 2000 Server.

Anyone with tips, please post comments/ tips.

Thanks

 

[Steven L Umbach]

Well from what you describe, that can not be done effectively because to do
everything else would require the user to be a local administrator. Local
administrators can of course install software. You can "hide" access to My
Network Places [user configuration/administrative templates/desktop] but
that still leaves ways for a user to search network shares via the browse
list with command line tools, etc. as long as netbios over tcp/ip is enabled
on the network. You really need to depend on share permissions to restrict
what a user can access on a network and not worry about what they can see. I
can see the vault of my bank when I walk in but that does not mean I can get
inside of it and loot it if I was so inclined.

If there is some way that the group can be a member of the local users
group only on domain computers then they will not be able to install most
software such as software that can be used by all users or software that
writes to the program files folder or system folder. If the client computers
are using XP Pro you can use Software Restriction Policies to restrict what
they can run and install with hash and path rules and the local
administrators can also be restricted by configuring the enforcement rule
though a knowledgeable user may figure out he can boot into safe mode to
bypass SRP if he is a local administrator. There are Group Policy settings
in Windows 2000 under user configuration/administrative templates/system
that can restrict what applications a user runs if the application can not
be renamed but that will apply to only domain users when configured at the
domain/OU level and any user with local administrator capabilities can logon
to the computer locally via an account they create to bypass Group Policy
user configuration applied at the domain/OU level.

If you absolutely have to make the users local administrators it still will
be worthwhile trying to use Group Policy to restrict them as many user may
not even know the concept of an administrator account but you have to beware
that it is not near a foolproof solution, particularly for the long run as
some users figure out how to bypass policy and others catch on. Also make
sure you read the full description of any Group Policy setting before you
implement it and set it up on a test OU before rolling out to all users. ---
Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;323525 -- adding
setup.exe, msiexec.exe, and install.exe may help for instance..
http://tinyurl.com/42dny -- the more restrictive Windows application
setting that is difficult to configure correctly.

 

[Guest]

Thanks Steve...

To clarify:

We have new XP Home machines from Dell. Two of them will be set up for
training. If they want to browse network shares, its not a terrible concern
as some of the employees will need to. BUT, basically, the paramount thing I
need to prevent is any user, other than Admin of course, from Installing
software on these PCs. Fun security free apps like Yahoo Messenger, AOL, and
other stuff folks can download and 'run here' type craptacular software that
will probably just be embedded with Spyware/Adware/malware, etc.

Would you mind telling me how to 'Lock it down' so folks are unable to
install software. And if its not too much to ask, once I create this
restricted group, how do I make it a roaming profile? Or is it already
roaming since its a domain group?

Thanks again.

Well from what you describe, that can not be done effectively because to do
everything else would require the user to be a local administrator. Local
administrators can of course install software. You can "hide" access to My
Network Places [user configuration/administrative templates/desktop] but
that still leaves ways for a user to search network shares via the browse
list with command line tools, etc. as long as netbios over tcp/ip is enabled
on the network. You really need to depend on share permissions to restrict
what a user can access on a network and not worry about what they can see. I
can see the vault of my bank when I walk in but that does not mean I can get
inside of it and loot it if I was so inclined.

If there is some way that the group can be a member of the local users
group only on domain computers then they will not be able to install most
software such as software that can be used by all users or software that
writes to the program files folder or system folder. If the client computers
are using XP Pro you can use Software Restriction Policies to restrict what
they can run and install with hash and path rules and the local
administrators can also be restricted by configuring the enforcement rule
though a knowledgeable user may figure out he can boot into safe mode to
bypass SRP if he is a local administrator. There are Group Policy settings
in Windows 2000 under user configuration/administrative templates/system
that can restrict what applications a user runs if the application can not
be renamed but that will apply to only domain users when configured at the
domain/OU level and any user with local administrator capabilities can logon
to the computer locally via an account they create to bypass Group Policy
user configuration applied at the domain/OU level.

If you absolutely have to make the users local administrators it still will
be worthwhile trying to use Group Policy to restrict them as many user may
not even know the concept of an administrator account but you have to beware
that it is not near a foolproof solution, particularly for the long run as
some users figure out how to bypass policy and others catch on. Also make
sure you read the full description of any Group Policy setting before you
implement it and set it up on a test OU before rolling out to all users. ---
Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;323525 -- adding
setup.exe, msiexec.exe, and install.exe may help for instance..
http://tinyurl.com/42dny -- the more restrictive Windows application
setting that is difficult to configure correctly.

Hi.

Setting up a new local domain group on our W2k Server. I'd like the log
in
users to do everything on the PC, EXCEPT Install programs, and search
network
shares. I just need to lock down those two settings for the group policy.

I started to set it up yesterday, but the options are endless, both a
blessing and curse for Windows 2000 Server.

Anyone with tips, please post comments/ tips.

Thanks

 

[Steven L Umbach]

I hate to tell you this but Windows XP Home computer can not join a domain
or be restricted via Group Policy. XP Home is not meant for enterprise
installations. My assumption when you said "domain" was that these computers
are XP Pro. About the best you can do is make sure that the users that logon
are not members of the local administrators group. If you were using XP Pro
you could use Software Restriction Policy to restrict what a user can
install on their computer. The link below explains that FYI but again you
can not use Software Restriction Policy or any Group Policy with XP Home.

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx

Roaming profiles are simply user profiles that are stored on a server and
follow the domain user around on whatever computer he or she logs onto. You
can also create mandatory profiles which will not save any changes a user
makes to their profile. The links below tell more. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;314478
http://support.microsoft.com/default.aspx?scid=kb;en-us;325853
http://support.microsoft.com/default.aspx?scid=kb;en-us;323368

Thanks Steve...

To clarify:

We have new XP Home machines from Dell. Two of them will be set up for
training. If they want to browse network shares, its not a terrible
concern
as some of the employees will need to. BUT, basically, the paramount
thing I
need to prevent is any user, other than Admin of course, from Installing
software on these PCs. Fun security free apps like Yahoo Messenger, AOL,
and
other stuff folks can download and 'run here' type craptacular software
that
will probably just be embedded with Spyware/Adware/malware, etc.

Would you mind telling me how to 'Lock it down' so folks are unable to
install software. And if its not too much to ask, once I create this
restricted group, how do I make it a roaming profile? Or is it already
roaming since its a domain group?

Thanks again.

Well from what you describe, that can not be done effectively because to
do
everything else would require the user to be a local administrator. Local
administrators can of course install software. You can "hide" access to
My
Network Places [user configuration/administrative templates/desktop] but
that still leaves ways for a user to search network shares via the browse
list with command line tools, etc. as long as netbios over tcp/ip is
enabled
on the network. You really need to depend on share permissions to
restrict
what a user can access on a network and not worry about what they can
see. I
can see the vault of my bank when I walk in but that does not mean I can
get
inside of it and loot it if I was so inclined.

If there is some way that the group can be a member of the local users
group only on domain computers then they will not be able to install most
software such as software that can be used by all users or software that
writes to the program files folder or system folder. If the client
computers
are using XP Pro you can use Software Restriction Policies to restrict
what
they can run and install with hash and path rules and the local
administrators can also be restricted by configuring the enforcement rule
though a knowledgeable user may figure out he can boot into safe mode to
bypass SRP if he is a local administrator. There are Group Policy
settings
in Windows 2000 under user configuration/administrative templates/system
that can restrict what applications a user runs if the application can
not
be renamed but that will apply to only domain users when configured at
the
domain/OU level and any user with local administrator capabilities can
logon
to the computer locally via an account they create to bypass Group Policy
user configuration applied at the domain/OU level.

If you absolutely have to make the users local administrators it still
will
be worthwhile trying to use Group Policy to restrict them as many user
may
not even know the concept of an administrator account but you have to
beware
that it is not near a foolproof solution, particularly for the long run
as
some users figure out how to bypass policy and others catch on. Also make
sure you read the full description of any Group Policy setting before you
implement it and set it up on a test OU before rolling out to all
users. ---
Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;323525 -- adding
setup.exe, msiexec.exe, and install.exe may help for instance..
http://tinyurl.com/42dny -- the more restrictive Windows application
setting that is difficult to configure correctly.

Hi.

Setting up a new local domain group on our W2k Server. I'd like the
log
in
users to do everything on the PC, EXCEPT Install programs, and search
network
shares. I just need to lock down those two settings for the group
policy.

I started to set it up yesterday, but the options are endless, both a
blessing and curse for Windows 2000 Server.

Anyone with tips, please post comments/ tips.

Thanks

 

[Guest]

Actiually I was incorrect! The Dell's we just got ARE XP Pro machines.

Again, what I need to do, is to prevent ordinary users from
installing/delteting programs, and installing/delting printers, and essential
XP O/S files. But I still need the 'locked down' pcs to be able to view
network shares for some essential files.

How would I go about setting this up? I'm wondering what tics I have to
tick off on the security tab of the Global-Domain Group I'll create.

Thanks again

I hate to tell you this but Windows XP Home computer can not join a domain
or be restricted via Group Policy. XP Home is not meant for enterprise
installations. My assumption when you said "domain" was that these computers
are XP Pro. About the best you can do is make sure that the users that logon
are not members of the local administrators group. If you were using XP Pro
you could use Software Restriction Policy to restrict what a user can
install on their computer. The link below explains that FYI but again you
can not use Software Restriction Policy or any Group Policy with XP Home.

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx

Roaming profiles are simply user profiles that are stored on a server and
follow the domain user around on whatever computer he or she logs onto. You
can also create mandatory profiles which will not save any changes a user
makes to their profile. The links below tell more. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;314478
http://support.microsoft.com/default.aspx?scid=kb;en-us;325853
http://support.microsoft.com/default.aspx?scid=kb;en-us;323368

Thanks Steve...

To clarify:

We have new XP Home machines from Dell. Two of them will be set up for
training. If they want to browse network shares, its not a terrible
concern
as some of the employees will need to. BUT, basically, the paramount
thing I
need to prevent is any user, other than Admin of course, from Installing
software on these PCs. Fun security free apps like Yahoo Messenger, AOL,
and
other stuff folks can download and 'run here' type craptacular software
that
will probably just be embedded with Spyware/Adware/malware, etc.

Would you mind telling me how to 'Lock it down' so folks are unable to
install software. And if its not too much to ask, once I create this
restricted group, how do I make it a roaming profile? Or is it already
roaming since its a domain group?

Thanks again.

Well from what you describe, that can not be done effectively because to
do
everything else would require the user to be a local administrator. Local
administrators can of course install software. You can "hide" access to
My
Network Places [user configuration/administrative templates/desktop] but
that still leaves ways for a user to search network shares via the browse
list with command line tools, etc. as long as netbios over tcp/ip is
enabled
on the network. You really need to depend on share permissions to
restrict
what a user can access on a network and not worry about what they can
see. I
can see the vault of my bank when I walk in but that does not mean I can
get
inside of it and loot it if I was so inclined.

If there is some way that the group can be a member of the local users
group only on domain computers then they will not be able to install most
software such as software that can be used by all users or software that
writes to the program files folder or system folder. If the client
computers
are using XP Pro you can use Software Restriction Policies to restrict
what
they can run and install with hash and path rules and the local
administrators can also be restricted by configuring the enforcement rule
though a knowledgeable user may figure out he can boot into safe mode to
bypass SRP if he is a local administrator. There are Group Policy
settings
in Windows 2000 under user configuration/administrative templates/system
that can restrict what applications a user runs if the application can
not
be renamed but that will apply to only domain users when configured at
the
domain/OU level and any user with local administrator capabilities can
logon
to the computer locally via an account they create to bypass Group Policy
user configuration applied at the domain/OU level.

If you absolutely have to make the users local administrators it still
will
be worthwhile trying to use Group Policy to restrict them as many user
may
not even know the concept of an administrator account but you have to
beware
that it is not near a foolproof solution, particularly for the long run
as
some users figure out how to bypass policy and others catch on. Also make
sure you read the full description of any Group Policy setting before you
implement it and set it up on a test OU before rolling out to all
users. ---
Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;323525 -- adding
setup.exe, msiexec.exe, and install.exe may help for instance..
http://tinyurl.com/42dny -- the more restrictive Windows application
setting that is difficult to configure correctly.

Hi.

Setting up a new local domain group on our W2k Server. I'd like the
log
in
users to do everything on the PC, EXCEPT Install programs, and search
network
shares. I just need to lock down those two settings for the group
policy.

I started to set it up yesterday, but the options are endless, both a
blessing and curse for Windows 2000 Server.

Anyone with tips, please post comments/ tips.

Thanks

 

[Steven L Umbach]

Well that is good news that you are using XP Pro. In that case when you
create users they will automatically be in the users group and or domain
users group for domain users. If you leave them in that group then they will
have very limited ability to install any application. They for instance
would not be allowed to install applications that can be used by all users
or applications that write to the system or program files folder. Regular
users will not be able to install/delete printers, uninstall major
applications, or delete system files. A user needs modify or full
permissions to a folder/file to delete a file or folder. Regular users will
have no more than read/list/execute permissions to any folder other than
their user profile folder under documents and settings and to the all users
profile - shared documents folder. In other words Windows XP is pretty
secure in a default installation. By default XP Pro computers use simple
file sharing until the computer is joined to the domain. You can disable it
in Windows Explorer/tools/folder options/view - use simple file sharing,
uncheck it so that you can see folder/file permissions in folder/file
properties.

The security tab on the groups for the domain is just to give permissions to
who can manage those groups - it has nothing to do with the permissions that
the users in the groups will have to access a file or folder. After you
create groups, you add the group to the security tab of the folder you want
them to access and that is where you assign permissions to the group to be
able to access the folder. Give a group only read/list/execute for instance
if you want users in the group to open the files but not write to the folder
or delete folders/files in the folder. A user will need write permission to
create folders/files and modify to modify or delete folders/files. The links
below explain ntfs permissions more. As I mentioned before you can also use
Software Restriction Policies to further restrict what applications a user
can install or run on their computer. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;308418
http://support.microsoft.com/?id=301195 -- also appropriate for Windows
XP/2003

Actiually I was incorrect! The Dell's we just got ARE XP Pro machines.

Again, what I need to do, is to prevent ordinary users from
installing/delteting programs, and installing/delting printers, and
essential
XP O/S files. But I still need the 'locked down' pcs to be able to view
network shares for some essential files.

How would I go about setting this up? I'm wondering what tics I have to
tick off on the security tab of the Global-Domain Group I'll create.

Thanks again

I hate to tell you this but Windows XP Home computer can not join a
domain
or be restricted via Group Policy. XP Home is not meant for enterprise
installations. My assumption when you said "domain" was that these
computers
are XP Pro. About the best you can do is make sure that the users that
logon
are not members of the local administrators group. If you were using XP
Pro
you could use Software Restriction Policy to restrict what a user can
install on their computer. The link below explains that FYI but again you
can not use Software Restriction Policy or any Group Policy with XP Home.

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx

Roaming profiles are simply user profiles that are stored on a server and
follow the domain user around on whatever computer he or she logs onto.
You
can also create mandatory profiles which will not save any changes a user
makes to their profile. The links below tell more. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;314478
http://support.microsoft.com/default.aspx?scid=kb;en-us;325853
http://support.microsoft.com/default.aspx?scid=kb;en-us;323368

Thanks Steve...

To clarify:

We have new XP Home machines from Dell. Two of them will be set up for
training. If they want to browse network shares, its not a terrible
concern
as some of the employees will need to. BUT, basically, the paramount
thing I
need to prevent is any user, other than Admin of course, from
Installing
software on these PCs. Fun security free apps like Yahoo Messenger,
AOL,
and
other stuff folks can download and 'run here' type craptacular software
that
will probably just be embedded with Spyware/Adware/malware, etc.

Would you mind telling me how to 'Lock it down' so folks are unable to
install software. And if its not too much to ask, once I create this
restricted group, how do I make it a roaming profile? Or is it already
roaming since its a domain group?

Thanks again.

:

Well from what you describe, that can not be done effectively because
to
do
everything else would require the user to be a local administrator.
Local
administrators can of course install software. You can "hide" access
to
My
Network Places [user configuration/administrative templates/desktop]
but
that still leaves ways for a user to search network shares via the
browse
list with command line tools, etc. as long as netbios over tcp/ip is
enabled
on the network. You really need to depend on share permissions to
restrict
what a user can access on a network and not worry about what they can
see. I
can see the vault of my bank when I walk in but that does not mean I
can
get
inside of it and loot it if I was so inclined.

If there is some way that the group can be a member of the local
users
group only on domain computers then they will not be able to install
most
software such as software that can be used by all users or software
that
writes to the program files folder or system folder. If the client
computers
are using XP Pro you can use Software Restriction Policies to restrict
what
they can run and install with hash and path rules and the local
administrators can also be restricted by configuring the enforcement
rule
though a knowledgeable user may figure out he can boot into safe mode
to
bypass SRP if he is a local administrator. There are Group Policy
settings
in Windows 2000 under user configuration/administrative
templates/system
that can restrict what applications a user runs if the application can
not
be renamed but that will apply to only domain users when configured at
the
domain/OU level and any user with local administrator capabilities can
logon
to the computer locally via an account they create to bypass Group
Policy
user configuration applied at the domain/OU level.

If you absolutely have to make the users local administrators it still
will
be worthwhile trying to use Group Policy to restrict them as many user
may
not even know the concept of an administrator account but you have to
beware
that it is not near a foolproof solution, particularly for the long
run
as
some users figure out how to bypass policy and others catch on. Also
make
sure you read the full description of any Group Policy setting before
you
implement it and set it up on a test OU before rolling out to all
users. ---
Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;323525 --
adding
setup.exe, msiexec.exe, and install.exe may help for instance..
http://tinyurl.com/42dny -- the more restrictive Windows application
setting that is difficult to configure correctly.

Hi.

Setting up a new local domain group on our W2k Server. I'd like the
log
in
users to do everything on the PC, EXCEPT Install programs, and
search
network
shares. I just need to lock down those two settings for the group
policy.

I started to set it up yesterday, but the options are endless, both
a
blessing and curse for Windows 2000 Server.

Anyone with tips, please post comments/ tips.

Thanks