Re: Security and the cobbler's children

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 02/29/04 

Date: Sun, 29 Feb 2004 01:05:04 GMT

Some software will not run if a user is not an administrator or power user so it
could be a permissions issue which would be easy enough to see by temporarily adding
them back to the power users group under your supervision to see if that fixes the
problem. If it does you may need to tweak permissions to allow them to use those
applications. Regmon and Filemon from SysInternals can help find permission problems
by running them using runas with admin credentials while logged on as a regular just
before trying to use problem application to see where access is being denied in the
log. Otherwise add a site that is experiencing difficulty to the trusted Web Content
Zone and set the security to medium to see if that helps which would indicate the
need to use the trusted web content zone or tweak the settings in the internet zone.
You may also need to review IE advanced settings/multimedia to see if they are
contributing to the problem. If you add iTunes to the trusted web content zone,
downloads will be allowed with the medium security setting. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;174360

"Greg Stigers" <gregstigers@spamcop.net> wrote in message
news:e5TTqVW$DHA.220@TK2MSFTNGP09.phx.gbl...
> This is a home use question, which I figure others have solved already, but
> I'm apparently not googling the right key words.
>
> I have set up a Windows 2000 domain, and my children use an XP Pro
> workstation. Since they have trouble following the rule against downloading
> and installing software, I have removed them from the power users group. Now
> they complain that web sites which use shockwave or flash do not work
> (although I suspect this is entirely an IE security settings issue). Also,
> my son cannot download tracks from iTunes. I think that I am willing to
> allow just these activities, but have not yet found exactly which setting(s)
> I need to change. Again, I'm sure that "the truth is out there", and I'm not
> googling the right key words. So, rather than "reinvent the wheel", I'm
> betting someone else here can at least provide a URL with the answer to
> life, the universe, and everything, and what settings to change in a custom
> GPO.
>
> <<http://www.despair.com/daretoslack.html>>
> --
> Greg Stigers, MCSA
> this space for rent
>
>

Relevant Pages

  • Re: Any hope for recovering from "chmod -r 777 /*"
    ... root privileges ... Backup your files (if you have custom zone settings, ... Apparently, another person said that /etc/pam.conf cannot have permissions greater 644, so they changed that, and then we could SSH into the box again. ...
    (comp.unix.solaris)
  • Re: 401 Unauthorized Question Again
    ... Charlie ... > Zone being there but invisible really has my curiosity peaked. ... > other power users out there who also have no knowledge about this. ... At the bottom of settings check the ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Running Programs with Elevated Privileges
    ... You could either try adding the domain users account to the local power users group ... on the domain computer where they need extra permissions or look into applying the ... compatws.inf template witch will give a user the same ntfs and registry permissions ...
    (microsoft.public.win2000.security)
  • RE: Client Permissions
    ... I checked user permissions on individual client ... For power users, they have been granted ... >> Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • Re: Unable to change message store location in Outlook Express
    ... If you never had read/write permissions then how were your messages being saved ... to give Power Users full permission to make required changes. ... when I try to change the message store to an empty ...
    (microsoft.public.win2000.general)