Allow WIN2K Power Users to Modify Network Properties??

[logixman]

Does anyone know how to allow Power Users, in Windows 2000 SP2, to change their network settings? The default is only to allow machine Administrators access to these properties.

My company has several field techs that connect to client routers, and therefore, must constantly change their network settings. The only way that I have found is to make them administrators of their own machines. This has worked in the past, however, some techs "get board" in the field and start modifying other system settings that they should not, then Help Desk ends up with a broken box.

I have searched high and low on Microsoft's site(s), but only found an article that glimpses into how to create your own security template and customize which registry entries you want to be able to configure. I need a fix that is a little less time consuming. Thanks for any help in advance!

 

[prescot9]

logixman,

I wish I could say something fantastic, but I believe that you must visit with the idea of security policies to do this. I'm faced with the same thing where I work...I wish I didn't have to put every user in the local Administrators Group, but these users came from Win9x boxes, and after all, they had full-control then!
Yes, I've had them disjoin these units from the Domain, in odrer to use Betty's Color Printer while visiting Houston, or some other slow-link site, only to call me up and ask me to rejoin the unit to the Domain...or after they've connected their Win2k unit to their @home ISP providers, and screwed up the DNS settings - ARGH!
But in the end, you'll enjoy the richness of security policies, give them a good looking over.
Let me offer this, too:
If your users are joined to a Domain, consider setting policy at the Domain level first - just my 2 cents.
Let me know what you think of the security policy stuff - I think it's kinda fun - you can tweak them up pretty tight, and even have some dark fun with your "frequent flyer" users!

 

[tlcscousin]

Have you tried delegating authority to their local machine?
This in theory should allow them to change all settings in the local machine but not in any other machines in the domain.
You might even be able to just delegate authority over the network settings.