Applying the COMPATWS.INF Security Template may also do the trick without
giving away as many rights.
Compatible (COMPAT*.INF). By default, Windows 2000 security is configured
such that members of the local users group have ideal security settings and
members of the local Power Users group have security settings that are
compatible with Windows NT 4.0 users. This default configuration enables
development of applications to a standard definition of a secure Windows
environment, while still allowing existing applications to run successfully
under the less secure Power User configuration. By default, all users that
are authenticated by Windows 2000 are members of the Power Users group. This
may be too unsecured for some environments, where it would be preferable to
have users, by default, only be members of the Users group, and decrease the
security on the Users group to the level where the applications run
successfully. The compatible templates are designed for such environments.
By lowering the security levels on specific files, folders, and registry
keys that are commonly accessed by applications, the compatible templates
allow most applications to run successfully. In addition, as it is assumed
that the administrator applying the compatible template does not want users
to be Power Users, all members of the Power Users group are removed.
-----Original Message-----
From: Leonard, Jeremy [mailto:jleonard@...]
Sent: Thursday, 15 August 2002 3:51 AM
To: 'vantage@yahoogroups.com'
Subject: RE: [Vantage] OT - W2K Active Directory - User Accounts
We added the Domain Users group to the Local Admin Group on each PC. This
solved the problem for us. Now, any authenticated users is a local
Administrator.
Thanks
Jeremy Leonard
IT Manager
K-T Corporation
-----Original Message-----
From: Gary Polvinale [mailto:garyp@...]
Sent: Wednesday, August 14, 2002 11:56 AM
To: vantage@yahoogroups.com
Subject: RE: [Vantage] OT - W2K Active Directory - User Accounts
Hi Steve,
You're right about that... I can see that Active Directory will definitely
have some "fun challenges". Converted the entire network over to W2K last
month. Setting up my first workstation (laptop) under the new setup. All
users are set up as Domain Users. I have two programs that refuse to run
under the user domain login. They work fine when I login as domain
administrator, or make the user a domain admin, or login as a local
administrator.
One is OpenOfficeOrg, the other a homegrown visual basic type executable.
OpenOfficeOrg gives me this error msg: "Star office has generated errors and
will be closed by windows." When I run the VB executable, I get this:
"Builtin.exe becomes a component of compiled product and has no stand-alone
function." Both programs work fine when the user has admin rights.
Also, I looked thru the W2K help, but couldn't find any mention of the
definitions to compare the priority of the built-in groups based on their
privileges. I thought I could escalate the level of the built-in group for
the users till they get the necessary rights to run the programs, but I
don't want to give them too many rights. And I know that is not the correct
way to handle this.
Thanks for the help. Give me your phone nbr if it gets too detailed.
Gary
-----Original Message-----
From: Steve Sanders [mailto:ssanders@...]
Sent: Wednesday, August 14, 2002 11:54 AM
To: vantage@yahoogroups.com
Subject: RE: [Vantage] OT - W2K Active Directory - User Accounts
Gary,
I've been using AD for a couple of years now and have been through some
"fun" challenges. I'm certainly not an expert on the subject but maybe I
can help. What's up?
\Steve Sanders
-----Original Message-----
From: Gary Polvinale [mailto:garyp@...]
Sent: Wednesday, August 14, 2002 10:20 AM
To: Vantage Group
Subject: [Vantage] OT - W2K Active Directory - User Accounts
Anybody comfortable with W2K Active Directory - I have a couple of
questions
about user accounts and permissions. Contact me off-group if you like.
Thanks in advance.
Gary Polvinale
Denton ATD
garyp@...
419-625-5200 x11
[Non-text portions of this message have been removed]
Yahoo! Groups Sponsor
ADVERTISEMENT
Useful links for the Yahoo!Groups Vantage Board are: ( Note: You must
have already linked your email address to a yahoo id to enable access. )
(1) To access the Files Section of our Yahoo!Group for Report Builder and
Crystal Reports and other 'goodies', please goto:
http://groups.yahoo.com/group/vantage/files/.
(2) To search through old msg's goto:
http://groups.yahoo.com/group/vantage/messages
(3) To view links to Vendors that provide Vantage services goto:
http://groups.yahoo.com/group/vantage/links
Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.
[Non-text portions of this message have been removed]
Useful links for the Yahoo!Groups Vantage Board are: ( Note: You must have
already linked your email address to a yahoo id to enable access. )
(1) To access the Files Section of our Yahoo!Group for Report Builder and
Crystal Reports and other 'goodies', please goto:
http://groups.yahoo.com/group/vantage/files/.
(2) To search through old msg's goto:
http://groups.yahoo.com/group/vantage/messages
(3) To view links to Vendors that provide Vantage services goto:
http://groups.yahoo.com/group/vantage/links
Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Useful links for the Yahoo!Groups Vantage Board are: ( Note: You must have
already linked your email address to a yahoo id to enable access. )
(1) To access the Files Section of our Yahoo!Group for Report Builder and
Crystal Reports and other 'goodies', please goto:
http://groups.yahoo.com/group/vantage/files/.
(2) To search through old msg's goto:
http://groups.yahoo.com/group/vantage/messages
(3) To view links to Vendors that provide Vantage services goto:
http://groups.yahoo.com/group/vantage/links
Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Useful links for the Yahoo!Groups Vantage Board are: ( Note: You must have
already linked your email address to a yahoo id to enable access. )
(1) To access the Files Section of our Yahoo!Group for Report Builder and
Crystal Reports and other 'goodies', please goto:
http://groups.yahoo.com/group/vantage/files/.
(2) To search through old msg's goto:
http://groups.yahoo.com/group/vantage/messages
(3) To view links to Vendors that provide Vantage services goto:
http://groups.yahoo.com/group/vantage/links
Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
giving away as many rights.
Compatible (COMPAT*.INF). By default, Windows 2000 security is configured
such that members of the local users group have ideal security settings and
members of the local Power Users group have security settings that are
compatible with Windows NT 4.0 users. This default configuration enables
development of applications to a standard definition of a secure Windows
environment, while still allowing existing applications to run successfully
under the less secure Power User configuration. By default, all users that
are authenticated by Windows 2000 are members of the Power Users group. This
may be too unsecured for some environments, where it would be preferable to
have users, by default, only be members of the Users group, and decrease the
security on the Users group to the level where the applications run
successfully. The compatible templates are designed for such environments.
By lowering the security levels on specific files, folders, and registry
keys that are commonly accessed by applications, the compatible templates
allow most applications to run successfully. In addition, as it is assumed
that the administrator applying the compatible template does not want users
to be Power Users, all members of the Power Users group are removed.
-----Original Message-----
From: Leonard, Jeremy [mailto:jleonard@...]
Sent: Thursday, 15 August 2002 3:51 AM
To: 'vantage@yahoogroups.com'
Subject: RE: [Vantage] OT - W2K Active Directory - User Accounts
We added the Domain Users group to the Local Admin Group on each PC. This
solved the problem for us. Now, any authenticated users is a local
Administrator.
Thanks
Jeremy Leonard
IT Manager
K-T Corporation
-----Original Message-----
From: Gary Polvinale [mailto:garyp@...]
Sent: Wednesday, August 14, 2002 11:56 AM
To: vantage@yahoogroups.com
Subject: RE: [Vantage] OT - W2K Active Directory - User Accounts
Hi Steve,
You're right about that... I can see that Active Directory will definitely
have some "fun challenges". Converted the entire network over to W2K last
month. Setting up my first workstation (laptop) under the new setup. All
users are set up as Domain Users. I have two programs that refuse to run
under the user domain login. They work fine when I login as domain
administrator, or make the user a domain admin, or login as a local
administrator.
One is OpenOfficeOrg, the other a homegrown visual basic type executable.
OpenOfficeOrg gives me this error msg: "Star office has generated errors and
will be closed by windows." When I run the VB executable, I get this:
"Builtin.exe becomes a component of compiled product and has no stand-alone
function." Both programs work fine when the user has admin rights.
Also, I looked thru the W2K help, but couldn't find any mention of the
definitions to compare the priority of the built-in groups based on their
privileges. I thought I could escalate the level of the built-in group for
the users till they get the necessary rights to run the programs, but I
don't want to give them too many rights. And I know that is not the correct
way to handle this.
Thanks for the help. Give me your phone nbr if it gets too detailed.
Gary
-----Original Message-----
From: Steve Sanders [mailto:ssanders@...]
Sent: Wednesday, August 14, 2002 11:54 AM
To: vantage@yahoogroups.com
Subject: RE: [Vantage] OT - W2K Active Directory - User Accounts
Gary,
I've been using AD for a couple of years now and have been through some
"fun" challenges. I'm certainly not an expert on the subject but maybe I
can help. What's up?
\Steve Sanders
-----Original Message-----
From: Gary Polvinale [mailto:garyp@...]
Sent: Wednesday, August 14, 2002 10:20 AM
To: Vantage Group
Subject: [Vantage] OT - W2K Active Directory - User Accounts
Anybody comfortable with W2K Active Directory - I have a couple of
questions
about user accounts and permissions. Contact me off-group if you like.
Thanks in advance.
Gary Polvinale
Denton ATD
garyp@...
419-625-5200 x11
[Non-text portions of this message have been removed]
Yahoo! Groups Sponsor
ADVERTISEMENT
Useful links for the Yahoo!Groups Vantage Board are: ( Note: You must
have already linked your email address to a yahoo id to enable access. )
(1) To access the Files Section of our Yahoo!Group for Report Builder and
Crystal Reports and other 'goodies', please goto:
http://groups.yahoo.com/group/vantage/files/.
(2) To search through old msg's goto:
http://groups.yahoo.com/group/vantage/messages
(3) To view links to Vendors that provide Vantage services goto:
http://groups.yahoo.com/group/vantage/links
Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.
[Non-text portions of this message have been removed]
Useful links for the Yahoo!Groups Vantage Board are: ( Note: You must have
already linked your email address to a yahoo id to enable access. )
(1) To access the Files Section of our Yahoo!Group for Report Builder and
Crystal Reports and other 'goodies', please goto:
http://groups.yahoo.com/group/vantage/files/.
(2) To search through old msg's goto:
http://groups.yahoo.com/group/vantage/messages
(3) To view links to Vendors that provide Vantage services goto:
http://groups.yahoo.com/group/vantage/links
Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Useful links for the Yahoo!Groups Vantage Board are: ( Note: You must have
already linked your email address to a yahoo id to enable access. )
(1) To access the Files Section of our Yahoo!Group for Report Builder and
Crystal Reports and other 'goodies', please goto:
http://groups.yahoo.com/group/vantage/files/.
(2) To search through old msg's goto:
http://groups.yahoo.com/group/vantage/messages
(3) To view links to Vendors that provide Vantage services goto:
http://groups.yahoo.com/group/vantage/links
Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Useful links for the Yahoo!Groups Vantage Board are: ( Note: You must have
already linked your email address to a yahoo id to enable access. )
(1) To access the Files Section of our Yahoo!Group for Report Builder and
Crystal Reports and other 'goodies', please goto:
http://groups.yahoo.com/group/vantage/files/.
(2) To search through old msg's goto:
http://groups.yahoo.com/group/vantage/messages
(3) To view links to Vendors that provide Vantage services goto:
http://groups.yahoo.com/group/vantage/links
Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/