Re: How to block users from installing other apps

jazzmanvibration_at_hotmail.com
Date: 07/04/03

  • Next message: Sakaba: "RE: How to block users from installing other apps" 
    Date: 4 Jul 2003 11:36:50 -0000
To: focus-ms@securityfocus.com
    ('binary' encoding is not supported, stored as-is) In-Reply-To: <20030703154633.89672.qmail@web13309.mail.yahoo.com>

    Another thing which has not been mentioned regarding the risks of having
    users in the local administrators group (I know, the list is endless), is
    that local administrators can choose the membership of local
    administrators. They can for example throw out domain admins from local
    administrators group.

    I had a user doing just that. I corrected the problem with AD
    policy "Restricted Groups".

    -----------------------------------------------------------------------------
    ------------------------------------------------------------------------------

  • Next message: Sakaba: "RE: How to block users from installing other apps"

    Relevant Pages

    • Re: WSS and Active Directory Account Creation Mode
      ... Add your domain users to the local Administrators group of the server ... WSS security will apply. ... I haven't tested adding groups to the local Administrators group. ...
      (microsoft.public.sharepoint.windowsservices)
    • Re: restricted groups for local admin rights
      ... I'm referring to local administrators and not domain administrators?) ... > describe you want to use the "member of" option for restricted groups. ... > way you can add a global group to the administrators group without affecting ...
      (microsoft.public.windows.group_policy)
    • Re: Forcing groups into the local admin account
      ... Does this remove the local Administrative account for the ... machine as being part of the local Administrators group? ... >of the GPO that you use. ...
      (microsoft.public.windows.group_policy)
    • Re: Remove users fom all Local Administrators!!
      ... of the group object to remove unwanted members. ... ' Bind to local Administrators group on the computer. ... ' Enumerate members. ...
      (microsoft.public.windows.server.scripting)
    • GPO Application
      ... there's no policy affecting them after said policy, ... and removing them from the local administrators group (this is an attempt to ... I even remember once within a server 2000 environment I locked down my own ...
      (Security-Basics)