Re: Optimizing Security w/ GPO
- From: "Bruce Sanderson" <bsanders@xxxxxxxxx>
- Date: Fri, 20 May 2005 12:27:59 -0700
"Users" can change their own settings, but not "system" settings.
Unfortunately, to install most software you have to be an Administrator,
although some can be installed by Power Users, or in a few cases, Users. I
question to ask yourself is why do users need to install software? If you
allow this behaviour, you essentially loose control over the workstations;
you increase the probability of getting viruses, spyware, Trojan Horses
etc.; having conflicts between different software packages and in general,
increased support costs.
You can populate Local Groups using Computer Configuration, Windows
Settings, Security Settings, Restricted Groups in a GPO - see
http://support.microsoft.com/?id=810076.
--
Bruce Sanderson MVP Printing
http://members.shaw.ca/bsanders
It is perfectly useless to know the right answer to the wrong question.
"Preacher Man" <nospam> wrote in message
news:OnISVMKXFHA.2256@xxxxxxxxxxxxxxxxxxxxxxx
> We have a Win2K domain w/ XP workstations. I want to give computer users
> the ability to change their settings and install software if needed.
> Right now I add their domain account to the local administrators group to
> accomplish this. I know this is an overkill. What would be the proper
> way of doing this through a GPO from the domain? Any ideas?
>
> Thanks,
> Preacher Man
>
.
- References:
- Optimizing Security w/ GPO
- From: Preacher Man
- Optimizing Security w/ GPO
- Prev by Date: Re: log off script and VPN
- Next by Date: Re: How to apply Computer Config to specific users?
- Previous by thread: Optimizing Security w/ GPO
- Next by thread: Set Environment Variables with Group Policy?
- Index(es):
Relevant Pages
|
