User rights.

[MikeM]

I have a question to everyone.
I have an issue with a few things with user rights. We have just moved
onto XP on our new units that we have from Windows 98. We have put the users
in the standard user group and not the local administrators group. The users
have been whining but I love it. I can see the non-installation of spyware
and all the other junk they like to load. Kazaa was one of these apps. I do
have an issue with the standard user group.
1. We like the users to be able to do some maintanence like defrag but are
no longer able to in the user group.
2. Since our I.T. dept isn't that big and budget the same I would like to
have the users be able to run the windows updates. Is this at all possible
in the standard user group?
3. We run our accounting database SCO and we use an app called Smart Term to
connect. This application doesn't run at all for the users unless we put
them in the admin group. I created an encoded script that uses the runas
administrator to run the app but would like to know if there is another way
around that?



Thanks,

MikeM

 

[Roger Abell]

If you have a Windows Server look into running
Software Update Services and configure the XP
machines to use your SUS for their updates. You
can then configure the updates to install automatically
with the users not being admins.
You application compatibility issues can result from a
number of things. Since it does run as an admin it is
most likely either permissions on its install folder, or
some temp files it uses, or else permissions on its
entries in the registry.
First, try granting Users group change/modify on the
application's install folder. If this does not cure it then
you should obtain filemon and regmon from the website
www.sysinternals.com and use these to determine where
else permissions need to be granted to the Users group.

 

[MikeM]

Thank you Roger.

If you have a Windows Server look into running
Software Update Services and configure the XP
machines to use your SUS for their updates. You
can then configure the updates to install automatically
with the users not being admins.
You application compatibility issues can result from a
number of things. Since it does run as an admin it is
most likely either permissions on its install folder, or
some temp files it uses, or else permissions on its
entries in the registry.
First, try granting Users group change/modify on the
application's install folder. If this does not cure it then
you should obtain filemon and regmon from the website
www.sysinternals.com and use these to determine where
else permissions need to be granted to the Users group.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
Term