XP groups and mysterious software installation

[HelenBN]

These 2 things go together, sometimes, but I may have 2 problems. Running 5 CPU network on Windows XP Home (about to upgrade to Pro). Password log-on and password screen saver utilized. Server is actually Server/Client. Gristoft AVG, ZoneAlarm Free, Ad-Aware, Spybot, firewall on Linksys router/hub, firewall off in Windows. All updates, no viruses, trojans, spyware or malware.

I work in a "honor" environment where everyone signs a computer usage contract which states that they won't install software, among other things. We did our network this way because we are a small non-profit org. and I had heard of problems getting programs like QuickBooks to run under a "User" group in Windows. I read

http://www.kellys-korner-xp.com/xp_groups.htm

which states that Users cannot share directories. What does that mean? They cannot change a directory's share properties, or they cannot use a shared directory? 'Cause alot of good that would do if they cannot use that mapped drive I have to the server.

I am about to change the group permissions to "User" to try to solve the following problem.

I have 2 CPUs that keep having GameHouse software loading mysteriously. I believe that these 2 people would not intentionally be doing this and no one else in the office would either. This happens about once a month. I haven't checked if it is the same calendar day, or weekday. I have not found any discussion online about this. These 2 do not have accounts with GameHouse, although they have RealPlayer installed. They never if ever use the RealPlayer and I haven't updated that one in a while. I can uninstall the Games through Add/Remove Software. Gamehouse is only a directory in Programs, so I can delete that. I don't see anything installing at startup in folder or in msconfig. I have just found and changed the permission in ZoneAlarm for

http://www.gamehouse.com

from "?" to "X" which means it would ask permission to access and now it is blocked. This showed up under program control.

One of these 2 also had Pinnacle Studio loaded and asking for registration at startup. Where did that one come from?

These 2 were my ones that HAD Plaxo that I just uninstalled about 4 weeks ago. I am suspicious.

The clients are not getting any emails from GameHouse or RealPlayer. I am stumped.

What am I missing? Will changing Permission from "Admin" to "User" fix this? I still feel like I have something lurking out there. Will "User" screw up my QuickBooks?

 

[cmeagan656]

Will "User" screw up my QuickBooks?

You don't need to add a local user account for each user using QuickBooks, or similar programs, on the client. For QuickBooks add domain\user (where domain is your domain and user is your user) to the Power Users group on the client and give the client's power user group "full control" of the Intuit folder.

Cheers.

 

[HelenBN]

Thanks cmeagan656. yes, this is what I expected, but that Power User still gets to install software, and that is what I would like to negate.

I will next look for a cookie that may be assoc. with GameHouse. I want to get this fixed BEFORE the upgrade to XP Pro.

 

[DTracy]

What you will need to do is change the permission on the quickbooks folder in the progam files directory to include "everyone". You will have to be an administrator to do this, and be sure to check the box that allows the user to change/modify, otherwise the program will still fail. After these permissions have be set, change the user profile permission back to "user" and test. Other changes may be necessary such as changing the permissions on the desktop icon, but this can be done using the same procedure outlined above. Perhaps you may also have to run the program compatibility wizard on the QuickBooks program. Esentially, what you will have when complete is a user that has admin permission to operate the QuickBooks program only.

Best regards,
David Tracy

 

[cmeagan656]

The way we've got it set up is that only administrators have local accounts on the machines. The domain users in the power users group can only log on to the domain, not the local machine. Then the only directory we give power user permissions to is the Intuit folder.

Oh, one other place you need to give power user rights to is anything to do with Intuit and/or QuickBooks in the registry.

By doing it this way our users can not install any programs because they don't have power user rights to anything but Intuit/QuickBooks and they don't have local admin rights on the computer.

Cheers.