Re: Non admin users cant do things they need to do

Kevin,

Could it be tht we're just missing a load of registry settings for our
default user?


You may want to check out this policy for the default and created users on your runtime:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System],"NoVisualStyleChoice"

--
=========
Regards,
KM

I always thought that users being unable to set the time was a
&!@!!XX$! decision.
However, I read in Raymond Chen's blog
(http://blogs.msdn.com/oldnewthing/) the reason why: If limited users
can set the time then they can fake out system event logs by changing
the time, doing something, and then setting it back. For example if
you wanted to "backdate" the system data logs, it would be easy to do
so.

I would recommend instead that if your systems are connected to the
internet you enable the internet time synchronization feature in the
time/date control panel. This allows the computer to automatically
get the time from public servers that exist for this purpose. In
addition to being configured through the time/date applet, there are
some simple registry keys available for this purpose:

Copy the following text into a text file, then name it "TimeSync.reg".
Double-click on the file to add data to the registry
Or the .reg file can be imported into component designer to create a
component. (Watch out for missing spaces in reg keys).


;---------- BEGIN TIMESYNC.REG -------------
Windows Registry Editor Version 5.00
;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
;Enable Time Sync using default windows servers

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters]
"Type"="NTP"
"LocalNTP"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NTPClient]
"SpecialPollInterval"=dword:00015180

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime\Servers]
"1"="time.windows.com"
"2"="time.nist.gov"

;---------- End TIMESYNC.REG -------------

There probably is some way that you could force a synchronization to
occur at bootup, using a logon script or something...


Having said that, if you absolutely decide you must configure this
right you can do it through a local security policy. (Include component
"Software:: System:: Security:: Applications:: Security Settings
Editor" in your build)

Afte building with that component installed, open the Local Security
Policy Console (Start, run, C:\Windows\System32\secpol.msc) you will
find a number of interesting settings under the following branch:

Security Settings
Local Policies
User Rights Assignment
"Change the System Time"

Be very careful with these settings: if you set this or any of the
other properties to "Users" group, then it will deny access to
everyone else. You must specify all groups that need this right. My
setting for this policy is Administrators, Backup Operators, Power
Users, and Remote Desktop Users.

Finally, I know that some of the GUI components in the "Administrative
Tools" world have a lot of dependencies, and thus tend to "bloat" your
run time. If you are concerned about the size of your image, you
probably want to figure out the registry keys associated with this
policy, and just add the appropriate registry data to your
configuration. (Use SysInternals REGMON while making the above change
to an XP desktop to figure out the reg keys).

SteveS
stevesATeyeDASHimagingDOTcom




Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit


"Kevin Benstead" <KevinBenstead@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:5840BBA2-17E2-4989-81DA-EA666BA1D972@xxxxxxxxxxxxxxxx
I've built my target with two users. "administrator" and "user". User is
not an administrator. I don't want him to be able to mess with the system
too much BUT there are a couple of things he needs to be able to do.

firstly i want my user to be able to have XP Visual Styles on his desktop.

however this is not available as an option on the display control panel
Only
windows Classic is available.

When i'm logged on as the administrator i can select Windows XP Style for
my
appearance.

How do i get that option for my non administrator user.

Secondly my user needs to be able to set the date and time.

the user account automatically logs on so it would be more convenient to
set
these things up as the user rather than having to log off and log on as
administrator. I'm thinking especially about what happens in our
production
when new systems are being built and the disks are cloned from a re-sealed
master disk.

If i can get XP styles onto the user account prior to cloning that's not
such a big deal BUT the time setting thing is more important. Our
processor
board has no battery backup until it's on the system so they all start off
at
1st Jan 2004 which is not good for the data logging we do when our
application is running.





.

Relevant Pages

  • Re: Non admin users cant do things they need to do
    ... only the administrator can. ... Could it be tht we're just missing a load of registry settings for our ... can set the time then they can fake out system event logs by changing ...
    (microsoft.public.windowsxp.embedded)
  • Re: Non admin users cant do things they need to do
    ... You mean they are along with the registry entires? ... i added the keys below to the registry (as administrator) logged off, ... can set the time then they can fake out system event logs by changing ...
    (microsoft.public.windowsxp.embedded)
  • Re: Non admin users cant do things they need to do
    ... can set the time then they can fake out system event logs by changing ... Double-click on the file to add data to the registry ... right you can do it through a local security policy. ... not an administrator. ...
    (microsoft.public.windowsxp.embedded)
  • Re: Non admin users cant do things they need to do
    ... i added the keys below to the registry (as administrator) logged off, ... can set the time then they can fake out system event logs by changing ...
    (microsoft.public.windowsxp.embedded)
  • Re: User rights in XPe on HP t5700 terminal - problem
    ... registry, but I thought that there is also normal mmc snap-in available ... > much any policy can be set/modified through registry. ... >> I have re-logged as Administrator and I saw that the user is in the ...
    (microsoft.public.windowsxp.embedded)
Loading