Limiting Power Users 1

[jshurst]

I'm setting up an AD network and trying to limit users to what they need to run applications. I really don't want them to be able to install programs, but I want them to be able to run them. I've limited them down to just the USER account but they can't run Quickbooks (and other apps).

Can someone tell me the best solution for this?

Thanks in advance,

J

 

[markdmac]

Quickbooks is a real pain in the rear end. Intuit is one of the worst companies when it comes to supporting secure workstations.

You will need to do 2 things to keep your users limited and still be able to run the Intuit products.

1. Give the users write access to the Quickbooks directory in Program Files.

2. Assign full control to ALL the Intuit registry keys in the windows registry. The tough part is identifying all of the needed keys as there are many and not all in one place.

The best way to assign the registry rights and NTFS permissions is to create a Quickbooks user group on the network. That way you can assign permissions to the group and not individual users. Then all you need to do is make your users members of the group.

The last time I did this I used REGMON to see what keys Quickbooks was accessing in the registry and gave permissions to those. There are a whole bunch of them in the CLASSES_ROOT hive in addition to the LOCAL_MACHINE hive.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[jshurst]

Thanks for the reply Mark. Unfortunately I don't have the necessary time to devote to this, so looks like I'll just be giving Power User rights :-( (at least for the time being)

 

[Stevehewitt]

Strongly recommend your don't give power user rights.

Power users group is a subset of the admins group rather than a superset of the users group. There's some rather funky ways to easily elevate from power user to admin - very easy to find using Google...!




Steve.

"They have the internet on computers now!" - Homer Simpson