Administrative access for non-administrators

[TheChaun]

We are having issues with one of our foreign office in regards to user access. We are running Windows XP Pro SP2 (in some cases, SP3) on our computers and we have an admin account setup for things like installing local printers and changing IPs to static.

Now we've had issues with users using thing to their advantage and installing unapproved software and we want to stop this.

The question I pose is, Does anyone know of a way to grant access to Add Printer and Network Properties on a local account thats not an administrator?

If this question should be anked in a different forum, please let me know. I'm new to the whole forum thing.

Thanks

 

[Lemon13]

try surun

http://kay-bruns.de/wp/software/surun/

 

[TheChaun]

That doesn't quite solve the issue. I don't want the user to be able to run other apps that we deem unnecessary (iTunes for example).

I was looking for maybe a registry fix, as opposed to third-party software, that can be applied to certain processes and applications.

Thanks for the link though.

 

[Davetoo]

Ah, the ever elusive "technical solution to a management problem". One of my favorites.

Set the policy at a management level that users are not to install any software not specifically approved by "X" department. When "X" department manager finds unapproved software installed on a users system, fired said user, and your problem will go away for a long time.

You can specify via GPO's exactly what software can and can't be run, if you want to get that finite in your control of systems.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[TheChaun]

As much as I love that solution, its not really viable. I'm a firm believer in terminating the user thats stupid enough to install personal software on a work machine.

I think this will fall short of what we need as well. In many cases its laptops that we need to enforce this on which are not on the domain. Trying to keep a list like that updated would be murder. Mostly from the aspect of getting the user to bring the equip in to update it.

 

[linney]

Network Configuration Operators", is a user Group.

Members in this group can have some administrative privileges to manage configuration of networking features.


Read about Manage Printers.

Assigning printer permissions

http://technet2.microsoft.com/windo...3bca-4201-a788-855b41ecf0371033.mspx?mfr=true

Manage Printers

http://technet2.microsoft.com/windo...aef2-49b5-b50a-e3f110b698a11033.mspx?mfr=true

Using Software Restriction Policies to Protect Against Unauthorized Software

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx

How To Use Software Restriction Policies in Windows Server 2003

http://support.microsoft.com/?id=324036

Microsoft Windows Server 2003 Software Restriction Policies

http://support.microsoft.com/default.aspx?scid=kb;en-us;824526&FR=1&PA=1&SD=HSCH

Description of the Software Restriction Policies in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310791&FR=1&PA=1&SD=HSCH