RE: Companyweb and guests - advice?

Hi Tom,

Thanks for your update.

You can find the Default Domain policy under the following node:

Open server management console, locate Advanced Management -> Group Policy
Management -> Forest -> Domains

And also you can run command "gpmc.msc" (no quotation marks) to launch the
Group Policy Management. You will find the Default Domain policy under the
node domain.local.

After you modifying any group policy settings, please run command "gpupdate
/force" on the server box and all client computers to take effects the
change.

Q: Also - under user properties->Terminal Services Profile , should I
check "Deny this user permissions to log on to any terminal server?"

Yes, you can check the option to deny the user remote logon LAN computers.

Please let me know if you have further question on the issue. I am glad to
help.

Have a nice day!

Sincerely,

Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
Thread-Topic: Companyweb and guests - advice?
thread-index: AcZ0e7C6V8i9oKQoRDKFn9/xyS+IaA==
X-WBNR-Posting-Host: 66.41.145.162
From: =?Utf-8?B?VG9tIE1j?= <TomMc@xxxxxxxxxxxxxxxxxxxxxxxxx>
References: <B025EAEC-A780-4AAE-AFE9-8A9C4A819524@xxxxxxxxxxxxx>
<VFVUYrAdGHA.188@xxxxxxxxxxxxxxxxxxxxx>
Subject: RE: Companyweb and guests - advice?
Date: Wed, 10 May 2006 14:50:02 -0700
Lines: 161
Message-ID: <868F2A21-3AED-49C9-A343-D1B03B0F1C5D@xxxxxxxxxxxxx>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
Newsgroups: microsoft.public.windows.server.sbs
Path: TK2MSFTNGXA01.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:267239
NNTP-Posting-Host: TK2MSFTNGXA01.phx.gbl 10.40.2.250
X-Tomcat-NG: microsoft.public.windows.server.sbs

Jenny,
Thank you for your response. Yes this is what I'm trying to do.

However I am not able to follow your #2 suggestion.
Where is ....."Default Domain Policy" as below? Is it under the Server
management console?

Default Domain policy -> Computer Configuration -> Windows Settings ->
Security Settings -> Local Policies -> User Rights Assignment -> Deny log
on through Terminal services. Double click it to check the option "Define
these policy settings" and click 'Add user or group' button to add these
user accounts to it. In doing so, we can deny these users logon to domain
computers to access internal resources that you do not want them to access.

Also - under user properties->Terminal Services Profile , should I check
"Deny this user permissions to log on to any terminal server?"

Thanks!
--
Tom


""Jenny wu [MSFT]"" wrote:

Hi Tom,

Thanks for posting here.

From your description, I understand that you want to let some internet
users to access some sub site of the Companyweb site. If I am off base,
please don't hesitate to let me know.

Based on my experience, you can create related user accounts in SBS
domain
for these internet users and set different permissions for user accounts
for the specific sub site. And control the users not access other
resources
in SBS 2003 domain.

If you only configure one domain user account shared for all these
internet
users, you will not track the user operations and they can not update
the
sub-site in the same time. And the credential also is public and it is
short of security.

You can refer to below steps:

1. Create new user accounts with Add user wizard in Server Management
console.

2. Enable Deny log on through Terminal services group policy and add
these
user accounts to the policy setting. You can find the policy as
follows:

Default Domain policy -> Computer Configuration -> Windows Settings ->
Security Settings -> Local Policies -> User Rights Assignment -> Deny
log
on through Terminal services. Double click it to check the option
"Define
these policy settings" and click 'Add user or group' button to add these
user accounts to it. In doing so, we can deny these users logon to
domain
computers to access internal resources that you do not want them to
access.

3. You can configure these users only access some specific web site. You
can do as follows:

a. Go to the Home page of the top-level site (or some specific subweb).
Click Site Settings link.
b. Click the "Go to Site Administration" link.
c. Click "View site collection user information" link.
d. Select one user who you want to assign site administrator permission.
e. Click the "Edit user information" button and check the "Site
collection
administrator" link.

What is more, you can perform the following steps to check the user
account
permissions:

a. Visit the sub-web as an administrator. For example, the address is:
http://wssserver/subwebname

b. Visit the following address directly:
http://wssserver/subwebname/_layouts/1033/siteusrs.aspx

c. This brings the Manage Site Collection Users page. Check on this page
if
this user is listed.

Hope above information helps! If you have further concern on the issue
please let me know. I am happy to be of assistance to you and look
forward
to your reply!

Have a nice day!

Sincerely,

Jenny Wu
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the
corresponding
newsgroups so that they can be resolved in an efficient and timely
manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check
the
"Notify me of replies" box to receive e-mail notifications when there
are
any updates in your thread. When responding to posts via your
newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In
doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly.
Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no
rights.

--------------------
Thread-Topic: Companyweb and guests - advice?
thread-index: AcZzp8UA1EucAvv8Rlqqyk1xErzNSQ==
X-WBNR-Posting-Host: 66.41.145.162
From: =?Utf-8?B?VG9tIE1j?= <TomMc@xxxxxxxxxxxxxxxxxxxxxxxxx>
Subject: Companyweb and guests - advice?
Date: Tue, 9 May 2006 13:33:02 -0700
Lines: 17
Message-ID: <B025EAEC-A780-4AAE-AFE9-8A9C4A819524@xxxxxxxxxxxxx>
MIME-Version: 1.0
Content-Type: text/plain;
charset="Utf-8"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Content-Class: urn:content-classes:message
Importance: normal
Priority: normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
Newsgroups: microsoft.public.windows.server.sbs
Path: TK2MSFTNGXA01.phx.gbl
Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:266882
NNTP-Posting-Host: TK2MSFTNGXA01.phx.gbl 10.40.2.250
X-Tomcat-NG: microsoft.public.windows.server.sbs

Running SBS2003 basic, dynamic dns - not a FQDN

I'd like a little advice on the best approach to using a
companyweb/sharepoint child site for network users and guests (parents)
in
our school to collaborate on a project. I'd like to set up a sharepoint
site
for collaboration on the project because of all the great tools. People
accessing this site though will not all be users on the network.

What's the best way for a guest to access the companyweb? Via RWW under
a
username created for the project that all can use?

Thanks in advance for any ideas.
Tom


--
Tom





.