Solved

Novell Admin user gets Administrator rights in W2k Pro

Posted on 2001-06-27
12
310 Views
Last Modified: 2008-03-06
Hi guys,

Is it possible to prevent a novell user with Admin rights from getting admin rights to a Windows 2000 Pro workstation. He can do with Power user rights on this machine.
0
Comment
Question by:benkeyser
  • 6
  • 2
  • 2
  • +1
12 Comments
 
LVL 11

Expert Comment

by:geoffryn
ID: 6231666
Sure.  Just make sure that he is not a member of the Administrators group.  By default you do not have to be a local workstation admin to run the netware admin apps.  Unless you are using NDS for NT or Zen Works, the user would not be added to the administrator group anyway.
0
 
LVL 1

Author Comment

by:benkeyser
ID: 6232652
1) Not using NDS for NT.
2) He gets added to the Administrators group the moment he logs on. Tried and tested.
0
 
LVL 11

Expert Comment

by:geoffryn
ID: 6232708
Do you have a  2000 or NT 4.0 domain that you are also logging onto?
0
 
LVL 3

Accepted Solution

by:
sverre earned 100 total points
ID: 6234582
"Not using NDS for NT"
How about ZEN-works?
Maybe a policy is creating a dynamic local user?
When the user not is logged into the machine, is there any useracount for that specific user in Usermanager?
If not, you are deffinitly using dynamic local user or having a domaincontroler.
If you have a domaincontroler, check the useracount in Usermanager for Domains (on the domaincontroler)
0
 
LVL 10

Expert Comment

by:DSPoole
ID: 6235527
Ben,

Your network is using ZENworks for Desktops 1.x/2.0/3.0 - the network admin has configured the Windows NT packages for something called Dynamic Local Users and given it Windows NT Administrator privleages.

This allows him to log into ANY Windows NT or 2000 computer attached to the network.  Even if you go and delete the user account on the computer.

Being that he is the network admin (and you are not) - it seems that this is his right.  If he is not supposed to be doing this then take it up with his supervisor.

However, if this is his job then as a user you have no rights to stop him.

Consider yourself fortunate that YOU have Administrator rights to your desktop - if it were up to me I'd adjust the properties of the Windows NT package and you would be logging in with just enough rights to launch Word (which is what we do - users can use applications but do not have rights to modify the desktop OS in any way - including installing software or making configuration changes).
0
 
LVL 1

Author Comment

by:benkeyser
ID: 6236900
DSPoole,

I will disregard your comment. As far as I am concerned, the discussion is not about the superiority of the Net Admin. I have admin rights (rightfully) to the Network AND workstation. The problem is that some of the techies with Admin rights log into my workstation and load software to experiment with, on my machine, causing all kinds of problems on my PC. Supporting clients with a PC that crashes constantly is painful.

If you have anything constructive to say, such as Sverre and Geoffryn and others, please do so. Else stay out. You have a very arrogant way of conveying your message. By the way, as I assume you are also an IT professional, I will ask you as pro to pro - please do not disgrace the other IT pro's with this attitude.

Ben Keyser.

By the way - we are not using ZEN - FYI
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 
LVL 3

Expert Comment

by:sverre
ID: 6236944
Just a thoght! ( i havent tested it my self!)
If you create a local useracount with no administrator rights on that particular user, does the local rights come from the domain or the local sam?
0
 
LVL 1

Author Comment

by:benkeyser
ID: 6237006
Well, I dived into NWAdmin just now and made an interesting discovery. One of the guys (obviously after realising that I created him a user acount WITHOUT admin rights to the workstation) created a polizy, using ZEN for a dynaminc user with ADMIN rights.

So, to MR Dspoole, it seemed that ZEN did play a role after all, allthough we do not use ZEN as a rule, ONLY to create backdoors, it seems.

Thanks for all who helped, but the expert points will go to Sverre this time.

Ben
0
 
LVL 1

Author Comment

by:benkeyser
ID: 6237009
See prevoius comment.
0
 
LVL 10

Expert Comment

by:DSPoole
ID: 6239983
Ben,

1)  I have seen many comments and questions from users trying to bypass administrator security and protocols - my mistake for assuming you were one of them.

2)  At least I can tell when ZENworks is in use :P
0
 
LVL 1

Author Comment

by:benkeyser
ID: 6245090
DSPoole

Accepted
0
 
LVL 1

Author Comment

by:benkeyser
ID: 6245097
DSPoole,

May I add my personal philosophy:

Assumptions is the mother oa all f!@#-ups!!

 ;)
Ben
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
INetware 6.5 and xserver integration 5 270
HP 2035n printer not printing in IPrint. LPR communication error 36 4 1,005
Novell Login Lag 1 577
Environment Variable from Novell 4 919
In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
Knowledge base software has turned out to be a quite reliable method for storing information, promoting collaborative work and for sharing valuable input and solutions.However, some organizations are trying to develop a knowledge base that works wit…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now