Re: MS Update - Admin Only

From: Steven L Umbach (sumbach_at_nospam-ameritech.net)
Date: 02/12/04 

Date: Thu, 12 Feb 2004 20:53:38 GMT

Yeah, that is what I meant that the account logon name is in the
administrators group. I usually check by using " net user username " also.
You got a lot of stuff going there with ipsec and a software firewall.
Nothing wrong with extra layers of security as long as they all work in
harmony and you remember what does what. The SPI router will be a good
investment. I like a perimiter device when using cable/dsl access. ---
Steve

"ClareOldie" <ClareOldie@nowhere.ie> wrote in message
news:eKoVjVU8DHA.3880@tk2msftngp13.phx.gbl...
> The group membership is the administrators group - that is what you meant?
>
> Thats good news on the Docs&Settings - unique id.
>
> I should have remembered what SurinGuard does - duh
>
> I use Outpost as software firewall but have (I hope) the machine's
listening
> processes blocked with an IPSec policy ( except Kerberos? ). I seem to
> remember some time ago checking on the GRC site without the firwall
running
> and coming up clean.But with all the patches since I guess there could be
> something 'open' again. I have a router ordered, NAT & SPI, so soon I will
> have another layer in place.
> The difficulty with all these 'layers of security' is that when something
> like this update thing happens its hard to tell whats stopping it <g>
> Thanks
>
> Seán
> ******************************************
>
> Steven Umbach wrote:
> > Glad you figured it out. That is strange that the admin account would
> > not let you do the account name change - it should, I would double
> > check the group membership of that account. I don't think that the
> > documents and settings folder will be a problem, the computer tracks
> > all users and groups by a unique sid number. As far a SurfinGuard I
> > should have suggested that you try booting into safemode with
> > networking while you had the problem. The reason is that most
> > applications and services are not started in safe mode and you could
> > troubleshoot from there. However never do that if you rely on a
> > software firewall only to protect your computer because it will be
> > disabled also in safe mode with networking. --- Steve
> >
> > "ClareOldie" <ClareOldie@nowhere.ie> wrote in message
> > news:e1sMA$M8DHA.2524@TK2MSFTNGP11.phx.gbl...
> >> Hi There Steve,
> >> thanks for that. Change done. I tried at
> >> first to do it from admin account but it wouldn't let me but it took
> >> from the account itself.
> >> Strange thing is the folder in Docs & Settings did not change its
> >> name. I appear to be using the folder with the old name. I wonder if
> >> this will cause some problems in the future.
> >> I finally found the culprit that was blocking my updates -
> >> SurfinGuard Pro. This is such a great programme that I had forgotten
> >> it. It has saved me on many occasion but this time it interfered.
> >> Thanks again for the help.
> >> Seán
> >>
> >> Steven Umbach wrote:
> >>> Hi Sean.
> >>>
> >>> Right click My Computer and select manage which will bring up
> >>> Computer Management where you will go to local users and groups.
> >>> Find the
> >>> account, open it and change the name. That's all there is to it and
> >>> it will still have same access, group membership. --- Steve
> >>>
> >>>
> >>> "ClareOldie" <ClareOldie@nowhere.ie> wrote in message
> >>> news:OYVmusI8DHA.488@TK2MSFTNGP12.phx.gbl...
> >>>> Steven,
> >>>> thanks for the suggestions for the computer, all of
> >>>> which are in situ and have been for some time, plus Adaware.
> >>>> One last question before I leave this:
> >>>> What is the best method of changing the logon name while ensuring
> >>>> that all of the settings for that account remain untouched. It's
> >>>> just I have never done this so I would like to make sure I don't
> >>>> mess things up.
> >>>> Seán
> >>>> **********************************
> >>>>
> >>>> Steven L Umbach wrote:
> >>>>> I have never used an account with a space in the logon name - try
> >>>>> an underscore_ between the two words or quotes around it next
> >>>>> time.
> >>>>> Well
> >>>>> you seem to indicate that your administrator accounts work fine
> >>>>> except for Update. I really don't know the reason for that and it
> >>>>> may
> >>>>> be Internet Explorer related. Try at least clearing your temporary
> >>>>> internet files and I would try adding Microsoft.com to your
> >>>>> trusted
> >>>>> web content zone and setting the security to medium to see what
> >>>>> happens and running SpyBot Search and Destroy on your computer to
> >>>>> check for parasites. There is a newsgroup dedicated to Windows
> >>>>> Update where you may also want to post. --- Steve
> >>>>>
> >>>>> http://support.microsoft.com/default.aspx?scid=kb;en-us;174360
> >>>>> http://mvps.org/winhelp2002/unwanted.htm# --- SpyBot available in
> >>>>> this link and other good info.
> >>>>>
> >>>>>
> >>>>> "ClareOldie" <ClareOldie@nowhere.ie> wrote in message
> >>>>> news:u7CZ3S97DHA.3420@TK2MSFTNGP11.phx.gbl...
> >>>>>> Sorry Steven I was a bit frustrated when I posted last!
> >>>>>>
> >>>>>> I got details for all accounts except one which gave the message
> >>>>>> "More help is available by typing NET HELPMSG 2221"
> >>>>>>
> >>>>>> This tells me it is an unknown username. I can log on with this
> >>>>>> so
> >>>>>> some part of Windows knows the name!
> >>>>>> This happens on one account only - which has admin privelages.
> >>>>>> The only difference with this one is that the loggon name is two
> >>>>>> words with a space between. Maybe this is the problem?
> >>>>>> I get similar results to yours for the other accounts.
> >>>>>>
> >>>>>> Regardless of which account I use - administrator or one within
> >>>>>> the administrator group - none will allow autoupdate. I get the
> >>>>>> same "Administrators Only" message.
> >>>>>>
> >>>>>> Yes I have, as far as I can tell, full admin rights in these
> >>>>>> accounts - changing passwords and other admin settings etc.
> >>>>>>
> >>>>>> Thanks again for your help
> >>>>>>
> >>>>>> Seán
> >>>>>> ***************************************
> >>>>>> Steven L Umbach wrote:
> >>>>>>> What do you mean it gave you nothing?? Can you do other
> >>>>>>> administrative duties like change your tcp/ip settings?? Auto
> >>>>>>> update can download and install updates without admin
> >>>>>>> credentials
> >>>>>>> if you do it by schedule. Below is what I get when I do net use
> >>>>>>> administrator on my computer to show what you should be seeing
> >>>>>>> [while logged on as an administrator]. --- Steve
> >>>>>>>
> >>>>>>> C:\Documents and Settings\Administrator>net user administrator
> >>>>>>> User name Administrator
> >>>>>>> Full Name
> >>>>>>> Comment Built-in account for administering
> >>>>>>> the computer/dom
> >>>>>>> ain
> >>>>>>> User's comment
> >>>>>>> Country code 000 (System Default)
> >>>>>>> Account active Yes
> >>>>>>> Account expires Never
> >>>>>>>
> >>>>>>> Password last set 2/1/2004 3:23 PM
> >>>>>>> Password expires Never
> >>>>>>> Password changeable 2/1/2004 3:23 PM
> >>>>>>> Password required Yes
> >>>>>>> User may change password Yes
> >>>>>>>
> >>>>>>> Workstations allowed All
> >>>>>>> Logon script
> >>>>>>> User profile
> >>>>>>> Home directory
> >>>>>>> Last logon 2/9/2004 11:16 AM
> >>>>>>>
> >>>>>>> Logon hours allowed All
> >>>>>>>
> >>>>>>> Local Group Memberships *Administrators
> >>>>>>> Global Group memberships *Group Policy Creator *Domain Users
> >>>>>>> *Schema Admins *Domain
> >>>>>>> Admins
> >>>>>>> *Enterprise Admins
> >>>>>>> The command completed successfully.
> >>>>>>>
> >>>>>>> "ClareOldie" <ClareOldie@nowhere.ie> wrote in message
> >>>>>>> news:%23$1JLSz7DHA.2088@TK2MSFTNGP10.phx.gbl...
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> Steven Umbach wrote:
> >>>>>>>>> Double check that you are indeed an administrator. You can
> >>>>>>>>> run "
> >>>>>>>>> net user username" at the command prompt where you substitute
> >>>>>>>>> your logon name for username and see if you are in the local
> >>>>>>>>> administrators group. --- Steve
> >>>>>>>>>
> >>>>>>>> I have checked the users profiles in control panel and I am a
> >>>>>>>> member of the administrators group. I also am the
> >>>>>>>> "administrator"
> >>>>>>>> for log
> >>>>>>>> on. The strange thing is your suggestion gives me nothing for
> >>>>>>>> this account.
> >>>>>>>> Any idea why?
> >>>>>>>> To go back to the original problem I tried doing the updates
> >>>>>>>> from
> >>>>>>>> the administrators account as well as using run-as from this
> >>>>>>>> account and another. Nothing doing from any of these.
> >>>>>>>> BUT when I activated the auto update feature it downloaded and
> >>>>>>>> installed some ten updates without a problem.
> >>>>>>>> Any further suggestions?
> >>>>>>>> Regards,
> >>>>>>>> Seán
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>>
> >>>>>>>>> "ClareOldie" <ClareOldie@nowhere.ie> wrote in message
> >>>>>>>>> news:%23$jSOlY7DHA.3432@TK2MSFTNGP11.phx.gbl...
> >>>>>>>>>> Whenever I try to do an update the MS page tells me I must be
> >>>>>>>>>> an administrator.
> >>>>>>>>>> I am - no one else uses this computer.
> >>>>>>>>>> What setting might I have missed that would cause this
> >>>>>>>>>> response? Thanks.
> >>>>>>>>>> Seán
>
>

Relevant Pages

  • Re: Rid AD of Circular Group Membership
    ... and have use on members if it is used there. ... Administrators group is still intact), nor do they have empowerments over ... Admins is being used for by the 30+ can be delegated I(ex. ... The quess is each has an account and uses it, ...
    (microsoft.public.windows.group_policy)
  • Re: Question on XP network security
    ... I'm not sure whether you meant adding each and every user account to ... that it gives every user full access to all other machines ACROSS the ... network security. ... > Add each user's domain account to the local administrators group. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: cannot add local user to local group
    ... You can control the Local Administrators group with the Restricted Groups Policy. ... This posting is provided "AS IS" with no warranties, and confers no rights. ... One local user account "test" and one domain user ... "Member of" tab is empty. ...
    (microsoft.public.win2000.active_directory)
  • Re: Log on as a batch job
    ... Depending on the task you are trying to run, the account you use may need ... be a member of the local Administrators group on the PC. ... And the entire point of Logon as a Batch Job privilege is to ... My brief experiments suggest that running a scheduled task requires the user ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Membership...
    ... Administrators group in some computers contrain members with deleted domain ... account such as this: ... >> REMOTELY using vb script. ... >> following script can remove the member of the Administrators group if the ...
    (microsoft.public.scripting.vbscript)