Re: User rights in win 2003 d

From: blastingfonda (blastingfonda_at_gmail.com)
Date: 03/21/05


Date: 21 Mar 2005 14:28:16 -0800

Some Guy wrote:

> By doing what you ask, you are circumventing the point of the user
> account and the built security behind a windows domain. Thus, why
users
> are not allowed to install apps on clients.
>
> Someguy

Yeah, it's a tradeoff. When you give a user full rights to install
apps, you giving them nearly-full access to the registry and to the
Windows and Program Files directories. That alone undermines the
security of your box in a major way. Locking a user down yet giving
them rights to the registry are mutually exclusive actions. The Power
Users group is a compromise but even that group has a number of
limitations on what apps it can install and yet at the same time it
gives users way too many permissions as well.

Anyone with a desire to obtain full admin rights to their box could do
so pretty easily once given the rights to install and run any app.



Relevant Pages

  • Apps Unable To Run w/o Admin Rights
    ... You can try to give your everyday account temp Admin ... rightd and then install the apps again, ... everyday account have rights to them. ...
    (microsoft.public.windowsxp.general)
  • Re: Restrict Users from Installing programs
    ... Some apps don't need any specific permissions or rights, ... > Administrators group and Power Users group and they will not have the ... rights to install apps. ...
    (microsoft.public.win2000.networking)
  • Re: Restrict Users from Installing programs
    ... and approved APPs in the directories ... Remove them from the>>> Administrators group and Power Users group and they will not have the ... >> rights to install apps. ...
    (microsoft.public.win2000.networking)
  • Re: Restrict Users from Installing programs
    ... >> Administrators group and Power Users group and they will not have the ... > rights to install apps. ...
    (microsoft.public.win2000.networking)
  • Re: When were scanf_s functions introduced?
    ... My knowledge of doing complicated MSI setup apps is fairly limited, ... installers, one that is a "full install" (includes everything and will be ... then the amount of space for the CRT ... the CRT dll MSVCR80.dll? ...
    (microsoft.public.platformsdk.security)