RE: User rights on Terminal Services

• Previous message: Sullivan, Glenn: "RE: User rights on Terminal Services"
• In reply to: Antoine Borg: "User rights on Terminal Services"
• Next in thread: Jay Lagorio: "RE: User rights on Terminal Services"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: "disciple" <marcus@nwnc.net>
To: "Antoine Borg" <antoineborg@onvol.net>, <focus-ms@securityfocus.com>
Date: Thu, 6 Mar 2003 23:10:50 -0600

Antoine,

More information will be required to assist with your questions. What are
the specific problems you are encountering when attempting to open the
files? Are you receiving any specific error besides the typical access
denied?

In order to create and administer COM servers in COM+ on Windows 2000, or
MTS in NT, you need to be a member of the "Administrator" role in the System
Application. Open Component Services in W2K, or MTS Explorer in NT, and
then expand the roles for the System Application. Make your changes there.
You can script this as well if you have a need to automate the solution. If
you need help, I can send you some scripts for automating COM+
administration.

If you are registering dll's outside of COM+ you'll require "change" access
to the HKEY_CLASSES_ROOT hive in the registry.

For actually using COM servers and ActiveX controls, it all depends on what
they're doing when they run, and what context the run under. If you're
running a COM component that creates and deletes accounts, then you'll need
to have Admin to run that component. If you're running a COM component that
simply calculates the sales tax on a purchase, then you'll only need
standard user rights. Make sense?

Please share more about what app you're having problems with, and what
precisely the app does. We can try to help more from there.

Marcus

-----Original Message-----
From: Antoine Borg [mailto:antoineborg@onvol.net]
Sent: Thursday, March 06, 2003 1:15 PM
To: focus-ms@securityfocus.com
Subject: User rights on Terminal Services

Hi ..

Win2k Server with all latest patches and Terminal Services installed.

We have a custom built application that we got from a third-party that is
causing problems through terminal services. Through my login the program
works w/o problems but I am an administrator and do not wish to have to
assign admin rights to every user who may need to access the stuff remotely.

Can anyone give me an indication as to what rights one may need for:

1) Opening and closing files from a folder on the server (I gave the
respective users full rights on these folders, but the problems still crop
up)
2) Creating/loading/using ActiveX Controls and COM servers.

I am not sure if there is any registry tomfoolery in it - what is the best
way to discover if the program uses the registry? (I'm slightly new at this;
I realise this is a newbie question, so go easy on me)

Oh, FYI, the problems I refer to are all ActiveX related and refer to the
fact that some controls cannot be loaded and/or created properly.

Thanks

Antoine

----------
Indecision is the key to flexibility.

• Previous message: Sullivan, Glenn: "RE: User rights on Terminal Services"
• In reply to: Antoine Borg: "User rights on Terminal Services"
• Next in thread: Jay Lagorio: "RE: User rights on Terminal Services"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]