PDA

View Full Version : Windows 2000 permissions



agent
22-12-2004, 05:01 PM
I've recently done an installation of Windows 2000, and everything is nice and dandy... except for permissions.

For example, running Outlook 2000 as a standard user required some additional files to be installed. Off went Windows Installer, and then stopped to say that it could not find media for the installation files, despite the Office 2000 CD being inserted.

Temporarily adding the user I was logged in as to the Administrators grouped solved this error, and they are now a standard user again and do not face this issue any longer.

I suspect that it has something to do with registry permissions (I ran RegMon while starting Outlook and got a lot of "Not Found" responses to key enquiries), and I get errors trying to write to HKLM as a normal user when installing Sylpheed-Claws.

However, the extent of these permissions is absolutely ridiculous - I cannot even make simple changes to the Programs tab in the Internet Options Control Panel applet. Any changes that I make look like they've been made, but close the applet and open it again, and we've reverted back to what they originally were. The same thing goes for some TweakUI settings.

I know don't suffer these outrageous restrictions running as a Power User on Windows XP, so should I try adding my users to the Power Users group? It should be noted that Outlook still got the same error in the Power Users group though.

I'd love to know if there are any changes I can make so that I can make changes to the Internet Options' Program tab, for example. I know that using regedt32 you can set permissions, but I'm really not sure which entries should have what permissions on them.

drb1
22-12-2004, 05:18 PM
I've recently done an installation of Windows 2000, and everything is nice and dandy... except for permissions.

For example, running Outlook 2000 as a standard user required some additional files to be installed. Off went Windows Installer, and then stopped to say that it could not find media for the installation files, despite the Office 2000 CD being inserted.

Temporarily adding the user I was logged in as to the Administrators grouped solved this error, and they are now a standard user again and do not face this issue any longer.

I suspect that it has something to do with registry permissions (I ran RegMon while starting Outlook and got a lot of "Not Found" responses to key enquiries), and I get errors trying to write to HKLM as a normal user when installing Sylpheed-Claws.

However, the extent of these permissions is absolutely ridiculous - I cannot even make simple changes to the Programs tab in the Internet Options Control Panel applet. Any changes that I make look like they've been made, but close the applet and open it again, and we've reverted back to what they originally were. The same thing goes for some TweakUI settings.

I know don't suffer these outrageous restrictions running as a Power User on Windows XP, so should I try adding my users to the Power Users group? It should be noted that Outlook still got the same error in the Power Users group though.

I'd love to know if there are any changes I can make so that I can make changes to the Internet Options' Program tab, for example. I know that using regedt32 you can set permissions, but I'm really not sure which entries should have what permissions on them.


M/S were trying, a little, at this point to tighten up the security on the O/S, but users wouldn't have it, which lead's to so many users running as Administrator.

Your supposed to log in make you change and log out like with root.

Most M/s users wont ware this.

D.

agent
22-12-2004, 05:22 PM
I'm well aware of good security practices.

The point is that I can't even specify what program I'd like to use for email, or make simple changes to the appearance of the shell.

I need these options to be different for each user, so I can't just use the Administrator account to specify settings and hope that these apply to the Users group too.

I know Microsoft isn't good at security, but restricting me from setting my mail application is definite overkill.

drb1
22-12-2004, 05:34 PM
I'm well aware of good security practices.

The point is that I can't even specify what program I'd like to use for email, or make simple changes to the appearance of the shell.

I need these options to be different for each user, so I can't just use the Administrator account to specify settings and hope that these apply to the Users group too.

I know Microsoft isn't good at security, but restricting me from setting my mail application is definite overkill.


Yes you can.

I have to think on it (Maybe godfather will come along) Something has been set to prevent users making these minor custom adjustments.

Half educated guess: users/ controlls/ ( something about allowing users to make changes).

Or desktop enviroments can the users customise their desktops, I think both are controlled from the same section.

D.

merlin
22-12-2004, 05:45 PM
Add the users to the Power Users group
Reset permissions accordingly



Whatever women do, they must do twice as well as men to be thought half as good. Fortunately, this is not difficult
- Charlotte Whitton

agent
22-12-2004, 10:21 PM
Thanks for the help, folks.

Adding the users to the Power Users group has solved the problem, and I can now make changes to settings and certain areas of the registry.

Still remains the issue that Outlook would still play up even run as a Power User, but that was fixed when I ran it with administrator privileges.

I must say I think it's pretty daft to restrict the Users group that much - they should at least be allowed to have full access to their user-specific settings.

beama
22-12-2004, 11:56 PM
I think its "all users" A hidden system folder, make your changes as a admin loggoff and shut down then restart and loggin as another admin (not super user) copy all directories files inclusive of hidden from the first admin login to the all users folder (and default user, is used when setting up new users by the os) this can also be done when installing new software

drb1
23-12-2004, 12:39 AM
I must say I think it's pretty daft to restrict the Users group that much - they should at least be allowed to have full access to their user-specific settings.[/QUOTE]

Agent,

This is 2k pro yes?

This was done so that N/work Admin could set all desktop the same throughout the sys, and little boys and girls couldnt change it without the admin code.

Big networks have conforming desktops to give user's and admin consistency/speed.

Once you come to understand it, there is more easy controll in 2kpro than any other O/s M/s have ever produced. Once you know it well you will find xp Pro a dummed down thing. and xp home well????

IMHO.

D.

agent
23-12-2004, 12:53 AM
Yes, it's Windows 2000 Professional.

I also use XP Professional, and I can't really make a comment on your statement (so far I've used XP far more than 2000), but from the point of view of someone who has administrator access on both XP and 2000, I reckon I'd find it extremely hard having a network administrator's policy enforced on me as an end user.

I guess I'm going to come to see whether I like XP or 2000 better, only time can tell now.