Re: Administrator rights

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 06/10/05


Date: Fri, 10 Jun 2005 15:42:47 -0500

Hi Carl.

FYI you may also want to post in an SBS newsgroup.

It helps to get terminology correct when you are asking a question. For
disks/folder/registry you set "permissions" for users and groups. User
rights are "tasks" that a user can do on a computer such as logon locally.
There are two types of folder permissions. Ntfs permissions which apply to
all users that access the share and share permissions that apply only to
users trying to access the share over the network. For network users ntfs
and share permissions both apply and the most restrictive permission of the
two will apply.

To create shares you need to be logged onto the computer as a local
administrator or power user. One a share is created you can modify share
permissions in the properties/sharing - permissions of the share. File and
print sharing must be installed and enabled on a computer to create a share.
You can also use the command net config server to view info on the server
service and use the command net share to see current shares.

If you are logged on as a local administrator you should be able to install
and uninstall applications unless ntfs permissions have been changed for the
administrators group and/or possibly user rights for administrators has been
modified. By default system and administrators will have full control
permissions on every folder on the computer with the possible exception of
user profiles under documents and settings. For sure administrators and
system should have full control to the root folder, program and files
folders and subfolders, documents and settings\all users folder and
subfolders, and \winnt or \windows folders and subfolders. --- Steve

"Carl Gross" <CarlGross@discussions.microsoft.com> wrote in message
news:9C05EE74-88EC-4394-AA43-7ADD3573C61C@microsoft.com...
>I have found it necessary to tighten up security on the user's machines
> lately.
>
> In order to start, I have been setting user rights on each persons disk
> with
> domain/local admins having full control and domain/local users have RWX
> rights. However, I haven't been able to set shares (the option doesn't
> even
> appear when I log on to the domain from the workstation). I went to
> setting
> the domain/local user for each machine admin rights but I still can't
> uninstall some programs.
>
> I'm stupmed please help. I have a SBS 2003 server with W2K SP4
> workstations.



Relevant Pages

  • Re: Shared permissions vs. security
    ... If they need to write to that folder [which should not be the drive/root ... administrators group by default so you are giving redundant permissions. ... It is best practice not to logon as a domain admin to domain workstation ...
    (microsoft.public.win2000.security)
  • Re: Dont Administrators have access to everything?
    ... folder, which the Limited users getaccess to. ... One of the Administrators is the Owner of nearly every ... the few that can be opened, but I thought the Administrators ... If you're an admin and you take ownership, and you replace permissions, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Strange share rights problems
    ... This rights are for the SHARE PERMISSIONS ... This posting is provided "AS IS" with no warranties, and confers no rights. ... The problematic folder is the folder under drive X and is called ... Users who belongs to the STAFF belongs also to Domain Users. ...
    (microsoft.public.windows.server.general)
  • Re: Utility/report for effective NTFS rights for a single user/group?
    ... that can determine the effective NTFS rights for a user or a group? ... Technically Rights and Permissions are two distinct things in NT-class ... simplistic in that you have to evaluate each folder individually. ...
    (microsoft.public.windows.server.general)
  • Re: Requesting general help with administartion
    ... you can use ntfs permissions to restrict users as to ... root/drive folder permissions so that users have only read/list/execute permissions. ... users can run/install and then exempt local administrators with the enforcement rule. ... I've just set up an XP Pro computer for a friend of mine, he's not so PC savvy and he ...
    (microsoft.public.windowsxp.security_admin)