Restricting changes on windows register keys

[Solomon]

Just allow some users to change values on register windows keys.

My insufficients steps:
1. Enable local and domain policy "Prevent access to registry editing tools"
2. Restrict regedit.exe and regedt32.exe use on ""Don't run specified
Windows applications" and "Restrict these
programs from being launched from Help" policies and enable "Prevent access
to the command prompt"
3. Restrict Permissions (right click on register key selected) for some
users.

But some users continues changing values on keys "restricted" (step 3)

How can I restrict completely permissions (security) to do changes on
register windows keys?

We're using WXP SP2 and W2K Server Standard SP4

THANKS

 

[da_test]

Just allow some users to change values on register windows keys.

My insufficients steps:
1. Enable local and domain policy "Prevent access to registry editing tools"
2. Restrict regedit.exe and regedt32.exe use on ""Don't run specified
Windows applications" and "Restrict these
programs from being launched from Help" policies and enable "Prevent access
to the command prompt"
3. Restrict Permissions (right click on register key selected) for some
users.

But some users continues changing values on keys "restricted" (step 3)

How can I restrict completely permissions (security) to do changes on
register windows keys?

We're using WXP SP2 and W2K Server Standard SP4

THANKS

Do your users have ADMIN privileges ?

Dave

 

[Solomon]

Of course not.
All are domain users (not local: Administrators & Power Users by example)
and they are member of Domain Users plus other groups (with scope Global and
type security) dependent of theirs departments (not Administrators, Domain
Admins, ... Admins)

THKS!
---

 

[da_test]

Of course not.
All are domain users (not local: Administrators & Power Users by example)
and they are member of Domain Users plus other groups (with scope Global and
type security) dependent of theirs departments (not Administrators, Domain
Admins, ... Admins)

THKS!

You are trying to restrict users access to the registry, but some how
they are accessing it? Have you a theory as to how they are
accomplshing it?

Are they logging on as local administrators is SAFEMODE
for example?
DAve

 

[Solomon]

I think they are accessing registry through DOS mode or remotely.
We don't use local users, just domain users. All default local users are
disabled.

 

[da_test]

I think they are accessing registry through DOS mode or remotely.
We don't use local users, just domain users. All default local users are
disabled.

What about the administrator account in safemode?
That's impossible to disable isn't it?

Dave