• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 217
  • Last Modified:

User priviledges...

What user priviliges should a basic user get?
I am having trouble with a basic user not being able to download ActiveX from the web and install them on the local machine. What active directory group policy settings should I enable to allow this.
Additionally, how do I give the user the ability to add and remove programs without making them an administrator?

0
dd021197
Asked:
dd021197
  • 5
  • 3
  • 2
  • +2
1 Solution
 
stevenlewisCommented:
make them power users.
0
 
SysExpertCommented:
3292 > Allow users to always install with System privileges. Administrator priv

 Windows 2000 has an Always install with elevated privileges Group Policy, that directs Windows Installer to always use System permissions when installing a program.

 I quote the Resource Kit:

 This policy extends elevated privileges to all programs. These privileges are usually reserved for programs that have been assigned
 to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add/Remove Programs
 in Control Panel. This policy lets users install programs which require access to directories that the user might not have permission to
 view or change, including directories on highly restricted computers.

 Skilled users can take advantage of the permissions this entry grants to change their permissions and gain permanent access to
 restricted files and folders. Note that the User Configuration version of this entry is not guaranteed to be secure.

 This policy can be implemented at Computer Configuration\Administrative Templates\Windows Components\Windows
 Installer or User Configuration\Administrative Templates\Windows Components\Windows Installer.

 When enabled, Windows Installer defaults to using System privileges for the effected users' or computers' install.

 When I enabled the policy in Computer Configuration, it did an Add Value name AlwaysInstallElevated, as a
 REG_DWORD data type, and set the data value to 1, at the following keys:

 HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer

 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalMachine\Software\Policies\Microsoft\Windows\Installer

 HKEY_USERS\<SID>\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalMachine\Software\Policies\Microsoft\Windows\Installer

--------------------------------------
I hope this helps !
0
How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

 
HousenetCommented:
-Go to tools ->internet options->security tab-> custom level button & enable the activex options(first 4 options) on the user's computer. This might be enough to allow them to install the activex componant. If not..have you conscidered installing the componant while the user is a power user or administrator of their local computer (& possibly revoking the right afterward) ?
0
 
LongbowCommented:
0
 
dd021197Author Commented:
housenet, I have tried looking at this. It is setup to be enabled, and we still can't download the active-x controls.
0
 
SysExpertCommented:
What about my suggestion ??
0
 
dd021197Author Commented:
sysexpert, no that didn't work - it's more a Internet Explorer setting that a Windows Installer one is it not??
0
 
stevenlewisCommented:
try making them power users, this will give them the necessary permissions
0
 
dd021197Author Commented:
how can I make network users Power Users? This group is only available to local users?
0
 
HousenetCommented:
-Add domain user from the domain to power users local..

-Right click on my computer & choose manage.
-Expand users & groups.
-Click on the power users or administrators group & add domain users from the domain (Look in: Domain)..
0
 
dd021197Author Commented:
housenet,
Should the user then login to their computer or to the domain?
0
 
dd021197Author Commented:
good job - got it :-)
0

Featured Post

Upgrade your Question Security!

Add Premium security features to your question to ensure its privacy or anonymity. Learn more about your ability to control Question Security today.

  • 5
  • 3
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now