Re: Least amount of privileges

It depends on what the domain users group has for permissions. Normally the
domain users don't have permissions at the root of a partition, the local
"Users" group is given read rights and within the . Is What permissions
does the domain users have and is there a local users group that is provided
ACL's at the root?

Does this third party program have a service account that runs the app for
the users in an elevated session? This can often be the case. One of the
ways you can determine this is to download filemon from www.sysinternals.com
and have it running while you are doing some of the functions that these
users perform with this app. Filemon will list out ALL activity for all
users so you will have to learn to start and stop it during the activity
only and also filter the details as much as you can. This info should show
you what user was creating , deleting, etc... From there you can determine
if it is the ordinary user or a service account. Also you should consider
moving this app off of your sql server and put it on a seperate server.
Install this on a pertition other than the system partition and you chould
be able to have a much higher level of authority and control.


--

Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.

"John" <IDontLikeSpam@xxxxxxxxxxx> wrote in message
news:%23WO4$MbLGHA.3936@xxxxxxxxxxxxxxxxxxxxxxx
Hello,

I apologize if this is a novice question as I'm not too familiar with
active directory and hope this is the appropriate place to post this.

We have a Windows 2000 Server that runs a 3rd party application that
connects to our SQL Server 2000 that is running on this same server. Our
users are getting to this 3rd party program through Terminal Services that
is set up on this same Windows 2000 Server. Our users are currently
members of ordinary Active Directory Domain Users. I notice recently that
this 3rd party program allows users that use this program to create files
and asks for folder locations, etc... which I'm a little weary about. In
this case I'd like to limit these ordinary Active Directory Domain Users
who are part of the Remote Desktop Users group that allows them to run the
Terminal Services to only be able to run this 3rd party program that
connects to the SQL Server 2000 database that is on this server and give
them write/read access to only the 'C:\Program Files\3rd party application
folder location\'. I was about to right click our server's C drive and
remove the Active Directory ordinary Domain User group from the security
tab but was second guessing in wondering if they would need some type of
write, execute or some other privileges to the Windows and SQL Server
system folders, files and subfolders and not have anything crash on them
while they're connected through Terminal Services. I just want to give
them the lease amount of privleges on this server and only 1 folder that
they can do their 3rd party writing/viewing permission to. Sorry if this
sounds confusing or is too much detail but am hoping this is possible.

Thanks in advance.

John



.

Relevant Pages

  • Least amount of privileges
    ... connects to our SQL Server 2000 that is running on this same server. ... party program allows users that use this program to create files and asks ... for folder locations, etc... ... I'd like to limit these ordinary Active Directory Domain Users who are part ...
    (microsoft.public.windows.server.active_directory)
  • Re: Default Domain Users group
    ... you were trying to allow local accounts but prevent domain accounts, ... Would it be safe for me to remove Domain users group from servers local ... but not sure why it would be in the server that has joined Domain. ...
    (microsoft.public.windows.server.security)
  • global power users
    ... I want to be able to add all my domain users to the power ... users group and have those rights publish to the server ...
    (microsoft.public.win2000.security)
  • Re: Access rights issue with Sharepoint - newbie question
    ... as the WSS server isn't running activedirectory. ... That I took the domain users out of the domain admins group on the WSS ... one that would be making all the site-changes to the SharePoint app as ... Administrators Group) - I believe it may be because the users are not ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: OWA distorted
    ... how do i know which group it is called on my server? ... domain users group? ... log entries to disk), and then open the current IIS log file. ... The old (exchange) server i formatted. ...
    (microsoft.public.exchange.admin)