user priveleges

[Guest]

I have a question about user privileges. I have a WinNT4 domain in my
home, but it's been about 5 years since I set it up originally and
I'm not sure how to set things up the way I want.

The hard drive on my stepkids' PC crashed recently. I replaced the
drive and installed XPPro. What I want to do is allow the kids to do
basic PC operations, (run programs, print, make individual user
settings, etc). What I don't want them to be able to do is install
and/or download anything.

I was able to set them up as a restricted user on the PC, but that
only works if they're logged into the PC. If they're logged into the
domain, the user settings on the PC are ignored (as I would imagine
they should be). How do I restrict their activities at the server? Or
is there another way to do this?

Thanks in advance...

Steve

 

[Chuck]

I have a question about user privileges. I have a WinNT4 domain in my
home, but it's been about 5 years since I set it up originally and
I'm not sure how to set things up the way I want.

The hard drive on my stepkids' PC crashed recently. I replaced the
drive and installed XPPro. What I want to do is allow the kids to do
basic PC operations, (run programs, print, make individual user
settings, etc). What I don't want them to be able to do is install
and/or download anything.

I was able to set them up as a restricted user on the PC, but that
only works if they're logged into the PC. If they're logged into the
domain, the user settings on the PC are ignored (as I would imagine
they should be). How do I restrict their activities at the server? Or
is there another way to do this?

Thanks in advance...

Steve

Steve,

What I think you're saying is you setup your stepkids new XP Pro computer with a
local account for them, and made that new account a member of a restricted
access group on that computer. Now you need to setup a domain account for them,
and make that domain account a member of the same restricted access group on
their computer.

So what you have is two (or more) accounts setup on your domain controller - one
yours, and the other theirs. All you need to do now is to make their domain
account a member of the restricted access local group on their computer. And
make your domain account a member of the administrative local group on their
computer.

 

[Guest]

What I think you're saying is you setup your stepkids new XP Pro computer with a
local account for them, and made that new account a member of a restricted
access group on that computer. Now you need to setup a domain account for them,
and make that domain account a member of the same restricted access group on
their computer.

I already have domain accts set up. They were previously logging on to the
doamin via a Win98SE box. What I'm trying to do on the new PC is prevent them
from installing anything. I'd like to keep them from downloading too, but if
I can keep them from installing things, that's probably sufficient. They
still need to be able to do all the "basic PC stuff" like running existing
programs, check email, surf the web, print, etc..

All you need to do now is to make their domain
account a member of the restricted access local group on their computer. And
make your domain account a member of the administrative local group on their
computer.

How do I create a local group on the XP box (and do I really need to for
only 2 people)? Right now, they each have their own user acct. Do they need
local accts on the XP box, or can I just have them log into the domain "as
is"?

Thanks,

Steve

 

[Chuck]

I already have domain accts set up. They were previously logging on to the
doamin via a Win98SE box. What I'm trying to do on the new PC is prevent them
from installing anything. I'd like to keep them from downloading too, but if
I can keep them from installing things, that's probably sufficient. They
still need to be able to do all the "basic PC stuff" like running existing
programs, check email, surf the web, print, etc..


How do I create a local group on the XP box (and do I really need to for
only 2 people)? Right now, they each have their own user acct. Do they need
local accts on the XP box, or can I just have them log into the domain "as
is"?

Thanks,

Steve

Steve,

Since the XP box has been setup, it already has an administrator account. Have
you setup any other accounts?

Regardless, when you setup Windows XP, the setup procedure predefined 9 local
groups, each with a different level of authority on the computer.

Start the (Control Panel - Administrative Tools) Computer Management applet.
Under System Tools - Local Users and Groups - Groups, you have the local groups.
Just add the appropriate domain account to the Users group, by double clicking
on the Users group, and hitting Add.

You can define additional local user accounts and groups, also. You should have
at least one local user account (like administrator) for local maintenance, not
requiring a domain logon.

You can view, and change, the rights of each local user / group using the
(Control Panel - Administrative Tools) - Local Security Policy applet. Under
Local Policies - User Rights Assignment, you will find all the policies which
you may need, and you add or remove a group or user from the appropriate policy.

And, assuming you're using NTFS on the XP computer, you can adjust access to any
files or folders, should you need to restrict the use of specific system applets
that aren't mentioned in the LSP.

 

[Guest]

Hi Chuck,

Well, I tried this, but I didn't see any options to keep a user from
installing programs. What I want to do is keep the kids from installing
anything, but still allow them to do the 'normal' stuff (check email, run
already installed programs, surf the web, print, etc) that they need to do.

Thanks,

Steve

 

[Chuck]

Hi Chuck,

Well, I tried this, but I didn't see any options to keep a user from
installing programs. What I want to do is keep the kids from installing
anything, but still allow them to do the 'normal' stuff (check email, run
already installed programs, surf the web, print, etc) that they need to do.

Thanks,

Steve

Steve,

Unfortunately, the Local Security Policy is all the distinction I know of
between 'normal' and 'extraordinary' stuff. It's kind of hard to define stuff
like installs; some installs (I have a dozen or so examples) involve only
copying stuff to a folder. Other installs require registry updates. You should
probably try making the kids accounts members of "Users" - that should allow
most normal stuff.