Re: Group Policy for WinXP local administrator rights

Tech-Archive recommends: Fix windows errors by optimizing your registry

> So, while we both know that the ideal case is not to give any user admin
> rights to a workstation, what would you suggest?

It's a difficult one alright. One of our customers allows all users to be
administrators of their PCs, probably through the exact setup that you
describe and that works well. The security (or some kind of) policy
dictates that if they mess up their machine, they're in trouble. This
results in shockingly few people installing all kinds of rubbish and
generating helpdesk calls.

However, in another environment with similar access granted, the machines
are infested with spyware and the like.

There's no real solution. And I think the problem lies in the original
request, rather than the solution. We can almost always come up with a
solution to a problem. The question is, how graceful, efficient and/ or
reliable is that solution.

I always want users (and admins) to run as users. In the past, I've setup a
number of PCs for friends and families (you know how it is, you work in IT
therefore you have to do it) and always setup the systems the same - an
administrative user (usually called super) and then users for the actual
users. I think that this should be the same in the work place, including
for us whom administer the systems. I don't need to be running as an
administrator on my box. I might on a server, but there's a number of ways
of achieving this.

I like Gee's solution.

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net


.

Relevant Pages

  • Save As option greyed out under File Menu
    ... I have setup MS Access 2003 on a Windows Server 2003 and when any user ... where I may have turned this off and how it could be affecting Administrators ... as they were not assigned this policy. ...
    (microsoft.public.access.setupconfig)
  • Re: IIS 4.0/NTFS/A.D.
    ... I have setup the appropriate users in the local domain ... administrators group. ... to the local machine groups. ... The server is a D.C. in it's own domain. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Quick: Where is the equivalent of the Display control panel in Vista?
    ... know they have a pocket administrators guide. ... but you keep coming up with crap about setup ... Assuming Windows recognizes the installer as an installer, ... automatically ask for elevation. ...
    (comp.sys.mac.advocacy)
  • Re: Access is Denied at RedeemTicket
    ... The user belongs to the group that is setup as the "users" group for the ... I tried adding it to the "Administrators" group of the ... user to the "SSO Administrators" group. ... >> Adapter, which is configured to use SSO. ...
    (microsoft.public.biztalk.general)
  • How come
    ... if you setup a new user with a password and remove the user admin permissions ... new user unless you setup a shortcut or admin password. ... to login or 2. ...
    (microsoft.public.access.security)