Re: User rights in win 2003 d

From: blastingfonda (blastingfonda_at_gmail.com)
Date: 03/21/05


Date: 21 Mar 2005 14:28:16 -0800

Some Guy wrote:

> By doing what you ask, you are circumventing the point of the user
> account and the built security behind a windows domain. Thus, why
users
> are not allowed to install apps on clients.
>
> Someguy

Yeah, it's a tradeoff. When you give a user full rights to install
apps, you giving them nearly-full access to the registry and to the
Windows and Program Files directories. That alone undermines the
security of your box in a major way. Locking a user down yet giving
them rights to the registry are mutually exclusive actions. The Power
Users group is a compromise but even that group has a number of
limitations on what apps it can install and yet at the same time it
gives users way too many permissions as well.

Anyone with a desire to obtain full admin rights to their box could do
so pretty easily once given the rights to install and run any app.



Relevant Pages

  • Apps Unable To Run w/o Admin Rights
    ... You can try to give your everyday account temp Admin ... rightd and then install the apps again, ... everyday account have rights to them. ...
    (microsoft.public.windowsxp.general)
  • Re: Restrict Users from Installing programs
    ... and approved APPs in the directories ... Remove them from the>>> Administrators group and Power Users group and they will not have the ... >> rights to install apps. ...
    (microsoft.public.win2000.networking)
  • Re: Restrict Users from Installing programs
    ... Some apps don't need any specific permissions or rights, ... > Administrators group and Power Users group and they will not have the ... rights to install apps. ...
    (microsoft.public.win2000.networking)
  • Re: Restrict Users from Installing programs
    ... >> Administrators group and Power Users group and they will not have the ... > rights to install apps. ...
    (microsoft.public.win2000.networking)
  • Re: Mmmm nobody want to give me an answer here
    ... maintenance tasks because of the choices that were made when it ... Of course if you install windows XP by itself without any ... When in the design of the OS this choice happened and why? ... way to remove everything this apps has installed simply by removing ...
    (microsoft.public.windowsxp.perform_maintain)