access for non-administrator accounts

[TheChaun]

We are having issues with one of our foreign office in regards to user access. We are running Windows XP Pro SP2 (in some cases, SP3) on our computers and we have an admin account setup for things like installing local printers and changing IPs to static.

Now we've had issues with users using thing to their advantage and installing unapproved software and we want to stop this.

The question I pose is, Does anyone know of a way to grant access to Add Printer and Network Properties on a local account thats not an administrator?

If this question should be anked in a different forum, please let me know. I'm new to the whole forum thing.

Thanks

 

[ForumKB]

I believe there is a GPO to allow non admins to add printers, not sure about the network connections though . . .


Adrian Paris

Paris Engineering Ltd

http://www.ForumKB.com

Google search of just tech forums & articles
(very useful, honest!)

 

[bigwiggs]

Yes there is a GPO (or local security policy) setting under "computer management\windows settings\security settings\local policies\security options". However I have found this doesnt do what you might think.

What will stop a normal user from adding a printer is the installation of the drivers, I think it is because they do not have modify rights to the %systemroot%\system32 directory. The GPO will not change the ntfs permissions on the folder, so an admin would have to put that there.

What I normally do is install the drivers for all the network printers, or in your case a local printer, on a fresh computer, then image it. When I roll out a computer from the office, the user has the ability to add a printer as needed without admin rights because the driver has already been installed on the PC.


For network connections, you will have to look to GPO as well. Under "User Configuration\Administrative Templates\Network\Network Connections" you will find many different options to choose from. Make sure you pay attention to the terminology for each policy as some people get the "enabled, disabled" setting confused and end up doing the complete opposite of what they need.

After you make your changes, computer configuration changes require a reboot, and user configuration requires a logoff/logon or sometimes just a "gpupdate" command to update the policies

Hope this helps