Maintaining user software functionality in an ever-changing software environment - permission problems?
Posted on 2007-08-07
One of my clients' domains will serve as an example of a growing problem: security vs. functionality in an ever-changing software environment. Windows SBS 2003, domain security, desktop users are domain users and are NOT local admins, as we do not wish them to install whatever software they fancy. Users running medical practice management software on their desktops, with various additional software packages for network fax, etc. Installation of these packages can be completed by a domain admin, and the fully-functional workstation turned over to the user. Over time (months), the functionality of the software begins to fade, problems arise such as java script errors and certain users no longer being able to use certain software packages on certain workstations, while they can use them on others.
If you log on to one of these problem workstations using a domain admin logon, the frequently disappear. If you elevate the user to local admin, the problems do not occur. Uninstalling / reinstalling the software package does not always fix the problem. Thus, I suspect these are permission issues. What causes them I do not know. I suspect they are related to the constant cycle of software updates (Windows, Java, Adobe, vendor, etc) which install new versions of files which may have different permissions than the ones that used to work.
How do you all deal with this? What is the most cost-effective way you have found to re-initialize a workstation? Ghosting would not work for most cases, as the workstation hardware involved at many clients is of various vintages.
I would also like a good link to the best, easiest and correct way to unjoin / rejoin a workstation to an SBS domain, reset the computer account, etc.