Windows 2003 Registry Editor and Users

[dpalacios]

Good Day Srs,

I have a question about Windows 2003 Server, We have many servers runing Windows 2003 and a several users that belong to my organization created in the Active Directory. I saw and option over the "regedit" for to connect to a network registry (any other pc) and i have make a test with a ramdon "power user" to connect to any of this servers and the results was positive, in fact, to be more especific, i recive an access denied when i try to open the folder "HKEY_LOCAL_MACHINE" but, i can look and modify registry entries inside the folder named "HKEY_USERS", then my question is... there is some kind of risk if i dont make an especific policy to prevent that conecctions?, is the "HKEY_USERS" a delicate registry files? an what can the users do to this machine if they change something on its parameters.

Thanks a lot for the help that you can give to me.

 

[markdmac]

If you give them access to HKCU then they can alter registry settings for administrator.

So, as an example, they could write a script to delete important data. Then configure it int he users RunOnce registry key. Next time Admin logs in the script runs and the admin deletes all files just by logging in.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[markdmac]

Correction to the above post, I referenced HKCU when I intended to say HKEY_USERS.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[dpalacios]

Thanks a lot Mr. Mark.

Regards,

DP