Power Users

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

We use auditing SW in our organisation which runs every 30 days. Problem is
the SW would appear to attempt to write to the registry on the local PC which
tells the PC not to check for another 30 days when the audit is complete.

If when the audit runs i am logged in as a DOMAIN USER then then the process
runs in task manager (I can see the process when i hit CNTRL - ALT - DEL).
The process starts at 5MB but continues on to consume 256MB of memory and
then i start to get virtual memory errors and the PC also runs extremely
slowly. Thie processs will run all day without completing. If i kill the
process from task manager then the PC functions as it should. However as the
audit is not completing then the process starts all over again next time a
DOMAIN USER logs into the PC.

However, If i log on as an adminitrator then the audit process runs in task
manager and consumes 5MB of memory for about 2 minutes then kills itslef off
and won't run again for another 30 days.

1 - I don't want to have to do this every 30 days as there are 40 PC's in
the org running this.

2 - I also don't want Domain users to have local admin rights as the PC's
are locked down in order that users can't gain access to the registry , Run
commmand, Control Panel etc..

Question 1 - Is there anyway that i can give all domain users rights to this
application only to write to the registry of the local PC, without having
access to anything else in the registry.

Question 2 - I would rather not have to give DOMAIN USERS Power User rights
as this would lead them to installaing stuff i don't want them to have access
to.

Any help/Advice greatly appreciated

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

John,

> Question 1 - Is there anyway that i can give all domain users rights to
> this
> application only to write to the registry of the local PC, without having
> access to anything else in the registry.

sure, just set an ACL on the relevant registry key. You can find out which
keys are used by the application by using regmon from www.sysinternals.com.
Be however careful about which key you allow users to write on as the same
keys could be exploited by viruses/trojans.

>
> Question 2 - I would rather not have to give DOMAIN USERS Power User
> rights
> as this would lead them to installaing stuff i don't want them to have
> access
> to.

Another alternative, but not free, is our product which allows you to manage
privileges (such group membership and user rights) on a per application
basis. In your case, for example, you set a policy that add the Power Users
group the process token of the selected application.

--
marco [alla] neovalens [punto] com

[ www.neovalens.com ]
----