Re: Security Templates

From: Asheesh Laroia (pan-news@asheeshenterprises.com)
Date: 05/11/02 

From: Asheesh Laroia <pan-news@asheeshenterprises.com>
Date: Fri, 10 May 2002 22:08:02 GMT

Of course they can install anything. If they can run DebPloit
(http://www.anticracking.sk/EliCZ/bugs/DebPloit.zip), they can get local
SYSTEM access through a simple, 40-kilobyte program.

MS has known about this for months, and hasn't fixed it. Maybe they
consider it a bug rather than a feature. For more info, just check out
my response to "Temporary User Rights" in this newsgroup.

-- Asheesh.

On Fri, 10 May 2002 11:30:36 -0400, Kyle B. wrote:

> Hello. I am trying to change the Power Users group so that they can NOT
> install ANYTHING. I need to have my users as Power Users so that they
> can run Legacy Applications but I don't want them to have the ability to
> install apps. I have been poking around the Console Root and checking
> out the security templates, especially the "setup security" templates.
> However I cant seem to find any policy regarding program installs.
>
> Other than taking away the ability for Power Users to install I want
> everything else to remain unchanged.
>
> Thanks in advance,
> -Kyle B.

Relevant Pages

  • Re: Power User Account corrupted?
    ... Are you sure these programs do not need you to be a local administrator? ... If other power users that are not also local administrators can install them ... to folders as powers users on the computers where it works. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Users vs. Power Users
    ... in article 05cb01c2d921$04be8c60$3301280a@phx.gbl, James Raaymakers MCSE at ... > Power Users can install software as long as the software ... > install software like this. ... > Power Users Group. ...
    (microsoft.public.win2000.security)
  • Re: What right allows full access?
    ... ACL to replace any anywhere in the substructure. ... the install drive has many places ... > I would not grant Full access to Power Users group if I could make a copy ... > and checked 'Replace permission entries on all child objects with entries ...
    (microsoft.public.windowsxp.security_admin)
  • Security Templates
    ... that they can NOT install ANYTHING. ... users as Power Users so that they can run Legacy ... Applications but I don't want them to have the ability to ... and checking out the security templates, ...
    (microsoft.public.win2000.security)
  • Re: Restricted Policy [WILDPACKET]
    ... Print operators only exists on servers and for the domain. ... Keep in mind that power users can create local computer ... For Windows XP Pro computers you can also use Software Restriction Policies ... install on their computers and that can be implemented in a Windows 2000 ...
    (microsoft.public.windows.group_policy)