Re: Registry Permission For Users

From: Danny Sanders (Danny.Sanders_at_NO-SPAMcpcmed.org)
Date: 11/16/04 

Date: Tue, 16 Nov 2004 10:11:30 -0700

> only way I have been successful for a user to open this software is to
make
> them a domain controller.

A domain controller is a computer. Do you mean domain admin?
If you mean domain admin, try applying the compatws.inf security template to
a computer then test to see if a "user" can run the program.
See:
http://support.microsoft.com/default.aspx?scid=kb;en-us;816585

Take them out of the domain admin group and as a last resort add the users
domain account to the local admin group on their computer. They will be
admin of their computer but not a domain admin, which is a HUGE security
hole in your domain. At least as admin of their local computer they can't
screw up your domain.

hth
DDS W 2k MVP MCSE

"rich7779" <rich7779@discussions.microsoft.com> wrote in message
news:253CF42A-F096-4E70-9E4E-143D40DF88BA@microsoft.com...
> i recently installed Win2K3 Server and have been having pretty good luck
> playing with it, but one thing so far has been stumping me. For some
reason,
> the users in the Domain cannot open our software that we use here at work.
> The error that comes up says "You currently do not have permission to
write
> to the registry...". I have tried everything that I can think of,
including
> given them administrative rights, full security permissions, etc., and the
> only way I have been successful for a user to open this software is to
make
> them a domain controller. I saw a couple registry options in the GPO and i
> changed the settings, but no luck. Any ideas how I can give them registry
> permissions without them being a domain controller? thanks

Relevant Pages

  • Re: DCPROMO Permission
    ... permissions to the Schema and Configuration Partitions. ... A domain admin modifies the permissions of the to-be-DC computer object, ... The delegatee runs dcpromo.exe after waiting for all the above to ... is there any other way to allow my tech support to create domain controller without giving them domain admin right? ...
    (microsoft.public.windows.server.active_directory)
  • Not enough disk space - error starting MMC
    ... We recently rebuilt our domain controller with Windows ... 2000 Advanced Server, running SP 4. ... logged in as the domain admin, I was unable to open any ...
    (microsoft.public.win2000.advanced_server)
  • Re: Prevent some Domain Admin Account from creating USERS, Groups, OUs
    ... if that person is not a DA or shouldn't be, delegate. ... User Account, Security Groups, OUs and modifying those object ... These Domain Admin Account handle administrative tasks over Domain ... Roles, Promote New Domain Controller, Configure AD Replication, DNS ...
    (microsoft.public.win2000.active_directory)
  • Re: Roaming profile problem
    ... I have created a folder on the e: partition of a domain controller for ... policy to add admins to the roaming profile. ... domain admin account on the server, cannot access or change the profile, ... When the profile directory is created, ntfs permissions are set to ...
    (microsoft.public.cert.exam.mcse)
  • Re: Prevent some Domain Admin Account from creating USERS, Groups, OUs
    ... This posting is provided "AS IS" with no warranties, ... User Account, Security Groups, OUs and modifying those object ... These Domain Admin Account handle administrative tasks over Domain ... Roles, Promote New Domain Controller, Configure AD Replication, DNS ...
    (microsoft.public.win2000.active_directory)