ntuser.dat security anomaly 1

[rmeredith25]

I have a Windows Server 2003 with XP Professional clients setup. I have 2 main profile accounts Admin which is completely unrestricted and Pupil. My problem is when i login as pupil there seems to be some hidden or unknown security in place which does not allow the pupil account to change internet options in Internet Explorer or access the control panel etc. This is good, however i am wanting to create other profile accounts similar and am unsure how this security is achieved. It isn't existent on any domain or local client group policies. I have found when i delete the local ntuser.dat file on the client pc's obviously all security and customisation of the pupil account is lost. Has this happened to anyone else or does anybody have any ideas how i might find out where this embedded security lies. Any help would be appreciated , thanks.

 

[BadBigBen]

some hidden or unknown security in place

I would conjecture that this is due to the PUPIL account being a very RESTRICTED account (non Admin)...



Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[rmeredith25]

Restricted where though for example? How do you mean "non Admin"?

Cheers

 

[BadBigBen]

have a read:

Increasing Security with Limited User Accounts and Restricted Groups

http://www.windowsecurity.com/artic...-Limited-User-Accounts-Restricted-Groups.html

Understanding User Accounts in Windows XP

http://www.dummies.com/WileyCDA/DummiesArticle/id-350.html

Also:

How to setup Security/Configuration Templates / Limit Access in Windows XP Prof

http://www.tech-recipes.com/windows_security_tips572.html

Creating a Custom Security Template Using the MMC Snap-in

http://msdn.microsoft.com/library/d...tingCustomSecurityTemplateUsingMMCSnap-in.asp

Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[linney]

If you like the way the Pupil is setup make it the default profile for all new users too.

HOW TO: Create a Custom Default User Profile (Q305709)

http://support.microsoft.com/support/kb/articles/q305/7/09.asp

Force all XP users to use the Default User profile
thread779-334751