Users vs. Power Users

From: James Raaymakers MCSE (jamesraa@pacbell.net)
Date: 02/20/03 

From: "James Raaymakers MCSE" <jamesraa@pacbell.net>
Date: Thu, 20 Feb 2003 12:45:35 -0800

Power Users can install software as long as the software
does not make changes to certain parts of the registry or
installs services. Most software installs require
modifications to the registry or run with System
Permissions. In these cases only an Administrator can
install software like this. Users cannot install anything.

Power users have Modify and Write permissions to the
Program Files folder. Users have only Read & Execute, List
Contents, and Read. This allows Power Users to Install
some software and run legacy applications not designed to
run in a secure NTFS environment.

Otherwise a Power User is the same as a restricted user.
You could create a OU, add the terminal users accounts to
a Terminal Users Group within that OU, create and apply a
group policy using the users administration template to
limit their access but maintain their membership in the
Power Users Group.

James

>-----Original Message-----
>Is there a resource out there somewhere that fully
>enumerates the differences between the Power Users and
>Users local groups under Win2k?
>
>We have a Terminal Server that we're trying to set up
with
>reasonable security. One of our apps absolutely will not
>run properly unless user is a power user. We have done
>security auditing and cannot find any failed object
access
>attempts (so it doesn't appear to be NTFS security
>related?).. The only thing that we have been able to do
>so far to get app to run is escalate user to power user
or
>local admin.. We _really_ don't want to go that route.
So
>I'm trying to look at differences in users / power users
>in detail to see what's going on here. Any help
>appreciated.
>
>Sorry to crosspost, don't know where this one goes..
>
>Thx, Chuck
>.
>

Relevant Pages

  • Re: Power User Account corrupted?
    ... Are you sure these programs do not need you to be a local administrator? ... If other power users that are not also local administrators can install them ... to folders as powers users on the computers where it works. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Power Users Lacking Privileges
    ... if your users are creating a Terminal Session to the Server (via ... local Power Users and local Administrators. ... is a member of the local Users group on each WIN2000/WINXP Pro ... registry entries during the install that cannot be installed by Power users. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Users vs. Power Users
    ... in article 05cb01c2d921$04be8c60$3301280a@phx.gbl, James Raaymakers MCSE at ... > Power Users can install software as long as the software ... > install software like this. ... > Power Users Group. ...
    (microsoft.public.win2000.security)
  • Re: What right allows full access?
    ... ACL to replace any anywhere in the substructure. ... the install drive has many places ... > I would not grant Full access to Power Users group if I could make a copy ... > and checked 'Replace permission entries on all child objects with entries ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Restricted Policy [WILDPACKET]
    ... Print operators only exists on servers and for the domain. ... Keep in mind that power users can create local computer ... For Windows XP Pro computers you can also use Software Restriction Policies ... install on their computers and that can be implemented in a Windows 2000 ...
    (microsoft.public.windows.group_policy)