Re: Design Guidelines for Non-Power Users?

From: Randy Birch (rgb_removethis_at_mvps.org)
Date: 10/19/04

Next message: Randy Birch: "Re: VB6 and Multimedia Problem"
Previous message: Bob O`Bob: "Re: Property Let / Get Procedures"
In reply to: Randy Birch: "Re: Design Guidelines for Non-Power Users?"
Next in thread: MikeD: "Re: Design Guidelines for Non-Power Users?"
Messages sorted by: [ date ] [ thread ]

Date: Tue, 19 Oct 2004 19:52:10 -0400

This may help, from the Win 2000 Prof. Res Kit. Hope the formatting doesn't screw up to badly as these are mostly in table format...

Default Settings
The following section describes the default permissions provided to different users.

Default File System and Registry Permissions
Table 13.6 describes the default file system and registry permissions.

Table 13.6 Default Settings for User Write Access Object
     Permission
     Description

      HKEY_Current_User

Full Control

User's portion of the registry.

%UserProfile%

Full Control

User's Profile directory.

All Users\Documents

Read, Create File

Allows Users to create files that can subsequently be read (but not modified) by other Users.

%Windir%\Temp

Synchronize, Traverse, Add File, Add Subdir

Each computer has one temporary directory for use by service-based applications that use this directory to improve performance.

\ (Root Directory)

Not Configured during setup

No permissions are applied to the root level of the directory because the Windows 2000 ACL Inheritance model would cause any root level permissions to affect all child objects, including those outside the scope of setup.

File System Permissions for Power Users and Users
Table 13.7 describes the default access control settings that are applied to file system objects for Power Users and Users during a clean installation of the Windows 2000 operating system onto an NTFS partition. For directories, unless otherwise stated (in parentheses), the permissions apply to the directory, subdirectories, and files.

  a.. %systemdir% refers to %windir%\system32.
  b.. *.* refers to the files (not directories) contained in a directory.
  c.. RX means Read and Execute.
Table 13.7 Default Access Control Settings for File System Objects File System Object
     Default Power User Permissions
     Default User Permissions

      c:\boot.ini

None

c:\ntdetect.com

None

c:\ntldr

None

c:\ntbootdd.sys

None

c:\autoexec.bat

Modify

c:\config.sys

Modify

\ProgramFiles

Modify

%windir%

Modify

%windir%\*.*

%windir%\config\*.*

%windir%\cursors\*.*

%windir%\Temp

Modify

Synchronize, Traverse, Add File, Add Subdir

%windir%\repair

Modify

List

%windir%\addins

Modify (Dir\Subdirs) RX (Files)

%windir%\Connection Wizard

Modify (Dir\Subdirs) RX (Files)

%windir%\fonts\*.*

%windir%\help\*.*

%windir%\inf\*.*

%windir%\java

Modify (Dir\Subdirs) RX (Files)

%windir%\media\*.*

%windir%\msagent

Modify (Dir\Subdirs) RX (Files)

%windir%\security

%windir%\speech

Modify (Dir\Subdirs) RX (Files)

%windir%\system\*.*

Read, Execute

%windir%\twain_32

Modify (Dir\Subdirs) RX (Files)

%windir%\Web

Modify (Dir\Subdirs) RX (Files)

%systemdir%

Modify

%systemdir%\*.*

%systemdir%\config

List

%systemdir%\dhcp

%systemdir%\dllcache

None

%systemdir%\drivers

%systemdir%\CatRoot

Modify (Dir\Subdirs) RX (Files)

%systemdir%\ias

Modify (Dir\Subdirs) RX (Files)

%systemdir%\mui

Modify (Dir\Subdirs) RX (Files)

%systemdir%\OS2\*.*

      %systemdir%\OS2
      \DLL\*.*

%systemdir%\RAS\*.*

%systemdir%\ShellExt

Modify (Dir\Subdirs) RX (Files)

      %systemdir%\Viewers
      \*.*

%systemdir%\wbem

Modify (Dir\Subdirs) RX (Files)

      %systemdir%\wbem
      \mof

Modify

%UserProfile%

Full Control

All Users

Modify

Read

All Users\Documents

Modify

Read, Create File

All Users\Application Data

Modify

Read

Note that a Power User can write new files into the following directories but cannot modify the files that are installed there during text-mode setup. Furthermore, all other Power Users inherit Modify permissions on files created in these directories.

  a.. %windir%
  b.. %windir%\config
  c.. %windir%\cursors
  d.. %windir%\fonts
  e.. %windir%\help
  f.. %windir%\inf
  g.. %windir%\media
  h.. %windir%\system
  i.. %systemdir%
  j.. %systemdir%\OS2
  k.. %systemdir%\OS2\DLL
  l.. %systemdir%\RAS
  m.. %systemdir%\Viewers
For directories designated as [Modify (Dir\Subdirs) RX (Files)], Power Users can write new files; however, other Power Users will only have read access to those files.

Registry Permissions for Power Users and Users
Table 13.8 describes the default access control settings that are applied to registry objects for Power Users and Users during a clean installation of the Windows 2000 operating system. For a given object, permissions apply to that object and all child objects unless the child object is also listed in the table.

Table 13.8 Registry Permissions for Power Users and Users Registry Object
     Default Power User Permissions
     Default User Permissions

      HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE \SOFTWARE

Modify

Read

HKLM\SOFTWARE\Classes\helpfile

Read

HKLM\SOFTWARE\Classes\.hlp

Read

HKLM\SOFTWARE\Microsoft\Command Processor

Read

HKLM\SOFTWARE\Microsoft\Cryptography

Read

HKLM\SOFTWARE\Microsoft\Driver Signing

Read

HKLM\SOFTWARE\Microsoft\EnterpriseCertificates

Read

HKLM\SOFTWARE\Microsoft\Non-Driver Signing

Read

HKLM\SOFTWARE\Microsoft\NetDDE

None

HKLM\SOFTWARE\Microsoft\Ole

Read

HKLM\SOFTWARE\Microsoft\Rpc

Read

HKLM\SOFTWARE\Microsoft\Secure

Read

HKLM\SOFTWARE\Microsoft\SystemCertificates

Read

      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion
      \RunOnce

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \Drivers32

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \Font Drivers

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \FontMapper

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \Image File Execution Options

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \IniFileMapping

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \Perflib

Read (via Interactive)

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \SeCEdit

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \Time Zones

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \Windows

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \Winlogon

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \AsrCommands

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \Classes

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \Console

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \ProfileList

Read

      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
      \Svchost

Read

HKLM\SOFTWARE\Policies

Read

HKLM\SYSTEM

Read

      HKLM\SYSTEM\CurrentControlSet\Control\
      SecurePipeServers\winreg

None

      HKLM\SYSTEM\CurrentControlSet\Control\
      Session Manager\Executive

Modify

Read

      HKLM\SYSTEM\CurrentControlSet\Control
      \TimeZoneInformation

Modify

Read

HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security

None

HKLM\HARDWARE

Read (via Everyone)

HKLM\SAM

Read (via Everyone)

HKLM\SECURITY

None

HKEY_USERS

HKEY_USERS.DEFAULT

Read

      HKEY_USERS.DEFAULT\SOFTWARE\
      Microsoft\NetDDE

None

HKEY_CURRENT_CONFIG

     = HKLM\System
      \CurrentControlSet
      \HardwareProfiles
      \Current

HKEY_CURRENT_USER

Full Control

HKEY_CLASSES_ROOT

= HKLM
\Software\Classes

-- 
Randy Birch
MS MVP Visual Basic
http://vbnet.mvps.org/ 
"Randy Birch" <rgb_removethis@mvps.org> wrote in message news:%23dpB5XjtEHA.1464@TK2MSFTNGP15.phx.gbl...
: As I recall, user's have read/write access to the folders under their
: profile, as well as to the HKEY_CURRENT_USER registry key. They may also
: have read/write access to other non-system folders on local or shared
: (mapped) drives or network paths as determined by the network admin.
: 
: -- 
: 
: 
: Randy Birch
: MS MVP Visual Basic
: http://vbnet.mvps.org/
: 
: 
: "George" <nospam@please.com> wrote in message
: news:OcoIRAgtEHA.2876@TK2MSFTNGP14.phx.gbl...
: : Hi,
: :
: : I am building a VB6 application that will need to run with limited (user)
: : privileges. I understand that non-power users only have write access to a
: : few specific directories on the system, as well as very limited registry
: : access.
: :
: : However, I cannot find a definitive guide as to exactly what resources are
: : available to limited users. Do you know of any such listing? What are the
: : guidelines to building VB6 applications that will be run in limited mode?
: :
: : Thank you very much!
: :
: : George
: :
: :
:

Next message: Randy Birch: "Re: VB6 and Multimedia Problem"
Previous message: Bob O`Bob: "Re: Property Let / Get Procedures"
In reply to: Randy Birch: "Re: Design Guidelines for Non-Power Users?"
Next in thread: MikeD: "Re: Design Guidelines for Non-Power Users?"
Messages sorted by: [ date ] [ thread ]

Relevant Pages

Re: Design Guidelines for Non-Power Users?
... The following section describes the default permissions provided to different users. ... Table 13.6 describes the default file system and registry permissions. ... File System Permissions for Power Users and Users ...
(microsoft.public.vb.winapi)
Re: Permissions on filesystem via Group policy
... can use the Resultant Set of Policy mmc snapin to see exactly what Group ... you want to disable "inherited permissions" in the advanced page if you only ... > Right-click File System and press Add File. ... Use the security settings of that GPO to specify ...
(microsoft.public.windows.group_policy)
Re: Running Programs with Elevated Privileges
... You could either try adding the domain users account to the local power users group ... on the domain computer where they need extra permissions or look into applying the ... compatws.inf template witch will give a user the same ntfs and registry permissions ...
(microsoft.public.win2000.security)
Re: Linux for Kids
... so this is equivalent to Olin file and directory permissions then. ... Olin keeps it's permissions in the file system, ... Is it sort of attached to each file and folder? ...
(comp.os.linux)
Re: Is it possible to run as administrator without password?
... Access Control Lists aren't exposed through the GUI in this version of Vista ... You can make a list of the registry and file system ... actually saw the Permissions locations in the properties dialogs for various ... If there are restricted registry locations involved, ...
(microsoft.public.windows.vista.administration_accounts_passwords)