Re: Users vs. Power Users

From: nex (nexmac@charter.net)
Date: 02/21/03 

Date: Thu, 20 Feb 2003 21:32:17 -0600
From: nex <nexmac@charter.net>

in article 05cb01c2d921$04be8c60$3301280a@phx.gbl, James Raaymakers MCSE at
jamesraa@pacbell.net wrote on 2/20/03 2:45 PM:

> Power Users can install software as long as the software
> does not make changes to certain parts of the registry or
> installs services. Most software installs require
> modifications to the registry or run with System
> Permissions. In these cases only an Administrator can
> install software like this. Users cannot install anything.
>
> Power users have Modify and Write permissions to the
> Program Files folder. Users have only Read & Execute, List
> Contents, and Read. This allows Power Users to Install
> some software and run legacy applications not designed to
> run in a secure NTFS environment.
>
> Otherwise a Power User is the same as a restricted user.
> You could create a OU, add the terminal users accounts to
> a Terminal Users Group within that OU, create and apply a
> group policy using the users administration template to
> limit their access but maintain their membership in the
> Power Users Group.
>
> James
>
>
>> -----Original Message-----
>> Is there a resource out there somewhere that fully
>> enumerates the differences between the Power Users and
>> Users local groups under Win2k?
>>
>> We have a Terminal Server that we're trying to set up
> with
>> reasonable security. One of our apps absolutely will not
>> run properly unless user is a power user. We have done
>> security auditing and cannot find any failed object
> access
>> attempts (so it doesn't appear to be NTFS security
>> related?).. The only thing that we have been able to do
>> so far to get app to run is escalate user to power user
> or
>> local admin.. We _really_ don't want to go that route.
> So
>> I'm trying to look at differences in users / power users
>> in detail to see what's going on here. Any help
>> appreciated.
>>
>> Sorry to crosspost, don't know where this one goes..
>>
>> Thx, Chuck
>> .
>>
you could just change permissions to the folder where the software is
installed to allow those specific users (ONLY) better access to already
installed apps.

Relevant Pages

  • Re: Power User Account corrupted?
    ... Are you sure these programs do not need you to be a local administrator? ... If other power users that are not also local administrators can install them ... to folders as powers users on the computers where it works. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Power Users Lacking Privileges
    ... if your users are creating a Terminal Session to the Server (via ... local Power Users and local Administrators. ... is a member of the local Users group on each WIN2000/WINXP Pro ... registry entries during the install that cannot be installed by Power users. ...
    (microsoft.public.windows.server.active_directory)
  • Users vs. Power Users
    ... Power Users can install software as long as the software ... modifications to the registry or run with System ... Power Users Group. ...
    (microsoft.public.win2000.security)
  • Re: What right allows full access?
    ... ACL to replace any anywhere in the substructure. ... the install drive has many places ... > I would not grant Full access to Power Users group if I could make a copy ... > and checked 'Replace permission entries on all child objects with entries ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Restricted Policy [WILDPACKET]
    ... Print operators only exists on servers and for the domain. ... Keep in mind that power users can create local computer ... For Windows XP Pro computers you can also use Software Restriction Policies ... install on their computers and that can be implemented in a Windows 2000 ...
    (microsoft.public.windows.group_policy)