XPP - simple sharing disabled - screwed up rights on 'all users'.

[Chris Cowles]

I have two home computers both running XPP SP2. They're connected by a
relatively secure wireless network. One is hardwired to a switch which is in
turn connected to a DSL modem and a WAP. (WEP enabled, administrator
password changed, mac addresses specified. The other (my kids') has only a
USB wireless network adapter. Simple sharing is disabled. I have an
administrator account ("Dad") and the others are limited.

Passwords and user IDs match on both machines. Shared folders appear and are
accessible as expected. I shared all individual 'my documents' folders but
revised security to allow "Parents" to access all and "Kids" to access only
their own and "Shared Documents". That works as intended.

Now comes the stupidity: I wanted to prevent the kids from messing around
with the 'all users' menus and 'Documents'. Not thinking in terms of group
policies, I edited permissions directly on the directories and restricted
rights to change. I applied that to all children. Now I can't save anything
to \all users\documents. In effect I saved my kids the trouble of messing it
up because I did that for them.

Is there a document somewhere that describes the default rights of users and
administrators to the 'all users' directories? If I'm really lucky, is there
a script somewhere that resets them?

Through this forum I found a reference to Doug Knox's XP security tool. I'll
probably license that and do what I should have done in the first place.

All well-intended suggestions or help is appreciated.

 

[Tom H]

You know, MS has it's own NNTP (Usenet) server with tons of MS-specific
newsgroups monitored by MS people.
Not that there aren't knowledgable people here, there are lots, but I know I
would post my questions there too:

Msnews.microsoft.com

 

[Chris Cowles]

Which is exactly where I posted the message:
microsoft.public.windowsxp.security_admin on msnews.microsoft.com.

 

[Malke]

I have two home computers both running XPP SP2. They're connected by a
relatively secure wireless network. One is hardwired to a switch which
is in turn connected to a DSL modem and a WAP. (WEP enabled,
administrator password changed, mac addresses specified. The other (my
kids') has only a USB wireless network adapter. Simple sharing is
disabled. I have an administrator account ("Dad") and the others are
limited.

Passwords and user IDs match on both machines. Shared folders appear
and are accessible as expected. I shared all individual 'my documents'
folders but revised security to allow "Parents" to access all and
"Kids" to access only their own and "Shared Documents". That works as
intended.

Now comes the stupidity: I wanted to prevent the kids from messing
around with the 'all users' menus and 'Documents'. Not thinking in
terms of group policies, I edited permissions directly on the
directories and restricted rights to change. I applied that to all
children. Now I can't save anything to \all users\documents. In effect
I saved my kids the trouble of messing it up because I did that for
them.

Is there a document somewhere that describes the default rights of
users and administrators to the 'all users' directories? If I'm really
lucky, is there a script somewhere that resets them?

Through this forum I found a reference to Doug Knox's XP security
tool. I'll probably license that and do what I should have done in the
first place.

All well-intended suggestions or help is appreciated.

I found this Knowledge Base article:

How To Set Security Settings Back to the Default
http://support.microsoft.com/?kbid=313222

HTH,

Malke

 

[Chris Cowles]

Thanks for your efforts. I did search but hadn't found anything. I'll review
the document and may have more questions.

 

[Guest]

(Replying from the web.)
I ran secedit /configure /cfg ?windir%\repair\secsetup.inf /db secsetup.sdb
verbose but now the user accounts don't appear on the welcome screen. They do
exist in documents and settings and can log in with ctrl-alt-delete.

Any clues as to how to restore them to the welcome screen? I did attempt to
refresh the welcome screen by toggling it on and off, to no avail.

Although I did log in with one of the 'missing' accounts, I did not attempt
to investigate whether the file rights issue I messed up has been resolved.