Re: Group Policy issues

From: Torgeir Bakken (MVP) (Torgeir.Bakken-spam@hydro.com)
Date: 10/04/02 

From: "Torgeir Bakken (MVP)" <Torgeir.Bakken-spam@hydro.com>
Date: Fri, 04 Oct 2002 03:53:07 +0200

John wrote:

> Hi. I am trying to tweak the policy settings with respect to power users
> and administrators. This is for a laptop computer that will be used at home
> with an ISP connection that the office doesn't know. I am having difficulty
> trying to get the power users to be able to:
> 1. Install Automatic Windows Updates.

Not possible without being administrator.

> 2. Configure the IP settings.

As far as I know, you need to be administrator for this as well.

> For a work around I could give someone Admin rights for a day cause I have
> the admin password change daily, however if this is the only way around
> these issues could someone tell me if there is an option to disable the add
> users. This way if/when a person logs in as the admin they cannot create
> another admin user. So in simple terms if you can help me with
>
> A. Allow a power user to
> 1. Install Automatic Windows Updates.
> 2. Configure the IP settings.
>
> or B. Admin option
> 1. Disable adding new users or change current users groups

An administrator is an administrator. It's very difficult (maybe impossible) to
limit it's powers.

> Also I want to disable the control panel as well for normal users and not
> the admin. However when I make the control panel disabled it does it for all
> users. Someone mentioned about the ntuser32.Dat file being renamed to
> ntuser32.man but that does not work any other ideas on this would be great.
> Thanks in advance for your time. 

--
torgeir
Microsoft MVP Scripting and WMI
Porsgrunn Norway

Relevant Pages

  • Re: Folder password
    ... domain administrator as well), would this be a wise thing to do? ... how your folder structure is set up. ... Anything you do, an admin can undo. ... The other power users sometimes need access as ...
    (microsoft.public.windows.server.sbs)
  • Re: Which user group for user workstations ?
    ... Administrator to Power Users and basic users. ... settings for settings, but it is dependent on the service to be running. ... I don't see the need for admin ...
    (microsoft.public.windows.server.sbs)
  • Re: Group Policy issues
    ... Well then the last resort is to hide the controls off of control panel I ... >> trying to get the power users to be able to: ... > As far as I know, you need to be administrator for this as well. ... >> For a work around I could give someone Admin rights for a day cause I ...
    (microsoft.public.win2000.security)
  • Re: Alternative to Windows Explorer
    ... One drawback if you use that "runas" approach then you really won't know ... Administrator versus their using their actual account. ... admin, a variation of their normal account. ... > pen testing experience in our state of the art hacking lab. ...
    (Security-Basics)
  • Re: Impact of removing administrative rights in an enterprise running XP
    ... The user probably had to be an administrator to get the virus in the ... You just apply the patch as an admin, ... Regardless, to speak more to the OP, yes, your support model will most ... Impact of removing administrative rights in an enterprise ...
    (Focus-Microsoft)