security

[Guest]

i hve a active directory operating on my LAN.I want to give user permission
to share
their folders but cant install softwares to their own.Some one told me to do
this using Group Policy.I m confused a little regardign Group and local
policies.Shuld i use group policies at domain level or liocal policies on
individual machines to serve my purpose.
Thanks in advance,

 

[Steven L Umbach]

Users must be at least power users on their computers to create shares which of
course will allow them to install much more software, though you might try removing
the power users group from the \winnt, \winnt\system32, and \program files folders
for ntfs permissions which would inhibit them from installing a lot of software. The
user right you probably are referring to is "create permanent shared objects" which
will not give the user the ability to create shares as some believe. It is best to
configure Group Policy at the domain or Organizational Unit level for ease of
administration and consistency of policy though there are exceptions where it may
make sense to use local policy if just a few computer are involved or for
esting. --- Steve