Quickly Add Group Admin Rights on Selected Folders

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I have the following environment at the parochial school I administer:
Windows 2003 Server
Windows XP Professional Workstations - 35 Users

I installed Accelerated Reader on our computer lab consisting of 20
computers. All of the lab users are very resitricted using GPO. My problem is
that Accelerated Reader runs off the server but requires users to have admin
rights on the WINNT folder. I was hoping to find a quick way to give the lab
users admin rights only to the WINNT folder and not add them to the local
admin group. Not sure if this can be done with scripting or GPO. Thanks for
the help.

Jon

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

In news4251020-29E6-4AD0-9684-6A21BE74939F@microsoft.com,
Jon <Jon@discussions.microsoft.com> typed:
> I have the following environment at the parochial school I administer:
> Windows 2003 Server
> Windows XP Professional Workstations - 35 Users
>
> I installed Accelerated Reader on our computer lab consisting of 20
> computers. All of the lab users are very resitricted using GPO. My
> problem is that Accelerated Reader runs off the server but requires
> users to have admin rights on the WINNT folder. I was hoping to find
> a quick way to give the lab users admin rights only to the WINNT
> folder and not add them to the local admin group. Not sure if this
> can be done with scripting or GPO. Thanks for the help.
>
> Jon

In addition to the other reply - it can't really be possible that the app
requires full control over %systemroot% and all its subfolders in order to
run. If it does (and, frankly, even if it's just subfolders users don't
normally have access to), I would be calling up the app mfr and screaming my
fool head off.

Users shouldn't need local admin rights to run anything. And any
folder/subfolder/regkey created by an application's installation routine
should set its own permissions.

This is merely sloppy programming, and if people don't complain, the
developers will never fix their ___.

www.sysinternals.com has two freebies you may find useful - filemon and
sysmon. I suggest you check them out to see what *exactly* this app is
expecting the user to be able to read from/write to, and grant *only* that.