Re: Tool for assinging users to be Admins for ONLY that app?
From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 08/20/04
- Previous message: Steven L Umbach: "Re: Remote users and password change"
- In reply to: James: "Tool for assinging users to be Admins for ONLY that app?"
- Next in thread: Marco: "Re: Tool for assinging users to be Admins for ONLY that app?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 20 Aug 2004 16:23:14 GMT
It is not a matter of giving users administrator rights but a matter of giving users
the needed file and registry permissions to run the application. The first thing to
try is to lean on the publisher and tell them you need to know what file and registry
permissions need to be modified in order for a user to run their application. Another
option may be to configure the computers with compatws.inf security template which
will give users the same file and registry permissions as power users without the
extra rights. You could temporally add a user to the power users group to see if that
would work. However that template will give users excessive permissions including the
ability to write/delete to the system folder.
http://support.microsoft.com/default.aspx?scid=kb;en-us;269259
http://support.microsoft.com/default.aspx?scid=kb;en-us;816585
Another alternative is to try and roll your own permission changes with the regmon
and filemon tools from SysInternals. Logon as a regular users and then use runas to
invoke first filemon just before you try to run the application. When the application
hangs check the screen for filemon for entries that show "access denied" . Then make
permissions changes to that file [or registry entry if using regmon], document the
change and try again. This can be a tedious process trying to track down the folders
and registry keys where a user is denied access but often users have success. Good
luck. --- Steve
http://www.sysinternals.com/ntw2k/source/filemon.shtml
"James" <James@discussions.microsoft.com> wrote in message
news:7D40FED3-B2C5-4710-A4AA-5188BB980A5A@microsoft.com...
> As some of you probably know, in a large corp. environment, there are some
> 2000 / XP machines that sit in confrence rooms or in other areas that NEED to
> be autologged onto a domain. We autolog the PC with a domain user account
> named "autolog". This Domain users account is in the local users group on all
> machines (by default).
>
> So, now to the problem:
>
> We cannot have these accounts have admin rights. Now, some applications
> being installed require admin rights. We cannot make an autologged account
> open as an admin...
>
> Does or is Microsoft have a tool that will allow IT to give a normal user
> admin rights to run certain applications? I know of the Run As command, but
> that is not useful to us because we would have to be there everytime the user
> would need to access the application.
>
>
> --
> James Ogden, MCP | A+
> www.binarydreams.us
- Previous message: Steven L Umbach: "Re: Remote users and password change"
- In reply to: James: "Tool for assinging users to be Admins for ONLY that app?"
- Next in thread: Marco: "Re: Tool for assinging users to be Admins for ONLY that app?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
