Re: Limit administrators permissions

From: Evan (Evan_at_discussions.microsoft.com)
Date: 12/02/04 

Date: Thu, 2 Dec 2004 10:35:03 -0800

We had then onsite. It can't be done.

All I want to do is remove the administrators group's ability to view
everyones profile in documents and settings. The rest of the workstation we
are locking down with AD group policies.

Here's my thinking:

Remove the administrators group from the documents and settings folder
permissions.
Add authenticated users and then change the permissions so that domain users
can login, their profile get's created and they can see their own docs ands
stuff but cannot access everyone elses.

 

"Danny Sanders" wrote:

> > One of the main applications that we have on the XP SP2
> > image is Hummingbird DM 5 and it needs the user to be
> > local admin, otherwise it does not install the Office
> > 2003 integration bits.
>
>
> I'm not the least bit familiar with Hummingbird 5, but from the above
> statement I wonder if one could set the user up as admin for the install and
> first run of the app, then remove the user form the admin group. Would the
> program run fine for them then? Or does the Office part get installed each
> time the program starts?
>
> If not I think your best bet would be to contact the maker of the app. There
> is not much you can do to lock down the admin of the computer.
>
> hth
> DDS W 2k MVP MCSE
>
> "Evan" <anonymous@discussions.microsoft.com> wrote in message
> news:09e001c4d897$addefd30$a601280a@phx.gbl...
> > One of the main applications that we have on the XP SP2
> > image is Hummingbird DM 5 and it needs the user to be
> > local admin, otherwise it does not install the Office
> > 2003 integration bits. It writes to HKLM etc etc. Bad app
> > but we have no choice. So that's why we need users to have
> > local administrator access. Believe me, we tried have it
> > the other way but it delayed our project to much.
> >
> > I would expect users not to know how to give themselve the
> > rights again. So if you have any ideas on how to do it I
> > would greatly appreciate them.
> >
> > Thanks
> > Evan
> >
> > >-----Original Message-----
> > >Not sure you can. Anything you do to lock them down would
> > have to be done as
> > >administrator. They have administrator rights to the
> > computer and they can
> > >reverse what ever you just did.
> > >
> > >You might try this link to see if the app will work when
> > logged in as a user
> > >instead of admin:
> > >http://www.microsoft.com/windowsxp/using/helpandsupport/le
> > arnmore/tips/danie
> > >ls1.mspx
> > >
> > >You might also see if they make a version compatible with
> > XP.
> > >
> > >
> > >hth
> > >DDS W 2k MVP MCSE
> > >
> > >"Evan" <anonymous@discussions.microsoft.com> wrote in
> > message
> > >news:081b01c4d887$b37d89b0$a301280a@phx.gbl...
> > >> Hi,
> > >>
> > >> In our company all users on XP are local administrators
> > on
> > >> their workstations to allow all the legacy apps to
> > >> function.
> > >>
> > >> I would like to restrict the administrators group rights
> > >> on the workstation and more importantly prevent users
> > from
> > >> accessing other users local profiles in Documents and
> > >> Settings. How would I go about doing that?
> > >>
> > >> Any help would be greatly appreciated.
> > >>
> > >> Thanks.
> > >> Evan
> > >
> > >
> > >.
> > >
>
>
>

Relevant Pages

  • Installing Software and Permissions
    ... etc etc on my TS Server. ... Security group and they'll have TS admin permissions... ... Added TS_Admins to the Local group on the TS Server - Administrators ... member of the TS_Admins group and try and install a piece of software.... ...
    (microsoft.public.windows.terminal_services)
  • Re: Admin Rights? > Cant Install
    ... Verify that both of you and the domain admins group are in the local administrators ... group by using "net localgroup administrators". ... She can't install ... yet she has admin rights. ...
    (microsoft.public.win2000.security)
  • Re: Non-Administrator Device Installation
    ... but unfortunately the "Silent Install" does not work in this ... of the Administrators group on this computer to install this hardware". ... >> Currently the device driver is installed via setupAPI by an administrator, ... >> in the Win2003 DDK uses this so that the same security settings are used ...
    (microsoft.public.development.device.drivers)
  • Re: Flash Install needs Administrator Rights
    ... administrators of the DCs for that domain. ... Our Group Policies give users non admin rights but I ... > AD without effect on the install. ...
    (microsoft.public.win2000.active_directory)
  • Re: Problems with ISA2004 during SP1 upgrade
    ... During ISA2K4 install, you will be prompted to run CEICW. ... you have to START "IIS Admin" service. ... >"The wizard could not export your settings for the ISA 2000 Server. ...
    (microsoft.public.windows.server.sbs)