Re: users can change system settings

From: Mike (realst8txNOSPAM@hotmail.com)
Date: 02/26/03 

From: "Mike" <realst8txNOSPAM@hotmail.com>
Date: Wed, 26 Feb 2003 14:53:58 -0800

Thanks Karl.
I've gone through the process of applying the default
setup security, then workstation security, however all
users still have complete access to anything on the
system. They can change registry settings, system
settings, time, etc. etc. Checked the admin group and no
users are included, nor are they in the power users group,
or any other group. Guest account is disabled. I would
prefer not to restrict these settings through group
policies due to the fact that all users, including the
administrator, are limited. Granted MS has provided a
convoluted method for applying group policies, then
applying another policy returning access to the admin. but
I would rather just get back to where the system was
before using permissions. If you have any other ideas, I
would like to hear them. I'm open to just about anything,
other than a re-install!

Mike

>-----Original Message-----
>How exactly were the results not what you expected? That
was the correct
>first thing to do, and should still be pursued until it
works as expected.
>
>After you apply setup security, you do also need to apply
basicwk or
>basicsv, and maybe another one [such as basicdc if a
domain controller] as
>well. Setup security does NOT equal a brand new computer
or server's
>permissions.
>
>Make sure users are not in the Administrators group, and
use REGEDT32 to
>check the permissions on the registry keys and values
that are being
>changed. AFAIK these two things are the only things you
should need to
>check concerning registry permissions, there are no other
magic settings
>hidden elsewhere.
>
>
>"Mike" <realst8txNOSPAM@hotmail.com> wrote in message
>news:04b101c2dceb$d205b590$8ef82ecf@TK2MSFTNGXA04...
>> Recently changed registry permissions to allow a piece
of
>> software to function in user acct (previously would only
>> run in Admin acct.) Neglected to make note of changes
and
>> now users have access to and can make system-wide
changes,
>> including editing of the registry. Is there an
automated
>> method to restore the default permissions to limit user
>> access back to original state? Have already tried using
>> mmc and supplied templates, including setup security.inf
>> but results are not what was expected. Any suggestions
>> are much appreciated.
>>
>> Mike
>
>
>.
>

Relevant Pages

  • Re: Security Settings
    ... I do know wot the settings were that I changed and I didn't edit the ... registry, just the permissions, and I cant work out why my access has been ... > those tweak programs almost always have disclaimers that state that if you ... Filesystem permissions, registry ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Registry Permissions on Win2K and XP Servers
    ... > store program related settings. ... user-configurable except by system administrators. ... They are not the permissions to set on the keys. ... You can also dump the idea of the registry and use an INI file, an XML file, ...
    (microsoft.public.vb.winapi)
  • Re: inquiry on putting a block on changing internet settings on IE7
    ... The sites in Internet Explorer's security settings are user-specific ... and are stored in the registry under: ... Back on the Permissions for ZoneMap dialog box, ... As a user-level settings, a knowledgeable person can go back into the ...
    (microsoft.public.security)
  • Re: Access denied error installing XP SP2 RTM
    ... >> now I think it will work, after I've given that key all permissions. ... >>So how am I supposed to find out what registry key causes the ... takes about an hour (partial installation and deinstallation of SP2 ... settings to the default ones just to install the service pack. ...
    (microsoft.public.windowsxp.setup_deployment)
  • RE: Changing Power Schemes, Possibly a Group Policy Issue
    ... This is a permissions issue on the registry. ... put the user in question in the power users group. ... > it will let me change the settings but it will not change ...
    (microsoft.public.windows.server.active_directory)