RE: Assigning an application

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Dennam (Dennam_at_discussions.microsoft.com)
Date: 02/17/05 

Date: Thu, 17 Feb 2005 14:31:07 -0800

Give the share authenticated user access so the computer can access the .msi.
Startup scripts are machine specific and run before a user logs on. As a
result they run in the context of the localSystem account on a computer. As
localSystem, they have privilege to do just about anything on a Windows
system. If a startup script needs to access network resources (e.g. a server
share) however, localSystem will not work. Given that, Group Policy will
change the security context of the script to that of the machine's computer
account, which is a valid AD user (e.g. a machine named WorkstationA will
have an account in AD called WorkstationA$--this account is hidden, but is
represented by the computer object when you are viewing an AD domain). The
machine account, just like any other user account in AD, is a member of the
Authenticated Users and can thus access any network resources that a member
of this group can. So, if you have a startup script that needs to access
server resources, make sure that the computer's machine account has
permissions to access those resources.

"Dennam" wrote:

> When I publish an application to User Configuration, users under the OU can
> see the app under Add/Remove. However, I when I assign an app (whether
> under U.C or Computer Config.), the program does not auto install.
>
>
> I may be off in my thinking, but if you assign an application, won't it
> automatically install (without requiring user intervention)? Thanks for any
> help!
>

Relevant Pages

  • RE: Authenticated users Group
    ... result they run in the context of the localSystem account on a computer. ... If a startup script needs to access network resources (e.g. a server ... Authenticated Users and can thus access any network resources that a member ...
    (microsoft.public.windows.server.general)
  • Re: Easy question on the local admin passwords
    ... Or even why worry about a local password on workstations. ... Set the account to a random long impossible to remember password and when you need to get into a machine and domain creds aren't working, reset the password with one of the hack CDs. ... The startup script has the obvious issues already discussed. ... GPO scripts which is not good because the SMS packages and GPO scripts ...
    (microsoft.public.win2000.security)
  • Re: Accessing security information from an authentication provider
    ... and the logon application is running under a privileged domain account. ... Because network resources are not part of the OS. ... authentication uses Kerberos in Windows domains, ...
    (microsoft.public.platformsdk.security)
  • Re: rundll32 printer command runs...but no printer!
    ... account and password to the command. ... >I run a very simple STARTUP script through win2000 AD on XP clients. ... > it should install a printer. ...
    (microsoft.public.win2000.active_directory)
  • Re: XP Pro printer share on domain
    ... If the resource being shared is on Brent, it will not matter who is logged on ... permissions on network resources granting access by the local accounts AND the ... Local account on pc sharing resource. ... Add global group BrentPrinterUsers to Domain. ...
    (microsoft.public.windowsxp.network_web)