how to stop users from stopping radmin server or change settings using GPO?

Posted on 2008-11-05
Last Modified: 2013-11-14
how can i stop users from stopping radmin server or change settings using GPO?
in other words, i want to deploy the radmin server 3.1 in my organization but i don't want users to be able to stop the radmin server or change the settings.
is it possible to do so from the group policy?
or can i modify the radmin msi file to do that?
help please.
Question by:DAL_Group
    LVL 40

    Expert Comment

    by:Vadim Rapp
    > or can i modify the radmin msi file to do that?

    In MSI by limiting permissions on the installed files, so if stopping the server involves running some program, or modifying files involves editing a file, that's who it's possible. But local admin users probably still can kill any process from task manager. For more detailed answer, you'll have to explain how it is possible to stop your radmin server and how to change the settings.

    Author Comment

    you can either right click the icon on the tray and then click "Stop radmin server" or "settings for Radmin server".
    and another way: go to all programs => Radmin server 3 => Stop radmin server or settings for Radmin server.

    i don't want users to be able to do that.
    thank you for the help.

    LVL 40

    Expert Comment

    by:Vadim Rapp
    I think, only if radmin server¹ has setting like "show tray icon". If that setting exists and is controlled by registry setting, then it's possible to create transform with that registry setting, so when it's installed, it does not show tray icon.

    ¹) of which I have no idea

    Author Comment

    it doesn't have such a setting.
    but even if it does how can i change the registry from the GPO?
    when i go to Computer configurations => windows settings => security settings => registry, and i right click it then click add key, it gives me the keys without the ability to modify them.
    i want to add the registry key because i can modify its security settings, take all privileges from the users and just give them to the administrators, but nothing happened.
    see the photo attached.
    LVL 40

    Expert Comment

    by:Vadim Rapp
    You don't change registry setting from GPO. You would alter installation package so that the installation would install that registry setting. For that, you would create so called Transform, which would be then deployed along with the installation - see tab "modifications" in the deployment package. But if there's no such setting in the program, there's absolutely nothing you can do. If the program is programmed to do X no matter what, then the only way to preclude it  from that is not to run the program. Even if you somehow managed to block program's access to the tray, it would almost certainly crash, since it's programmed to use it.
    LVL 40

    Accepted Solution

    ...speaking of configuring registry access in GPO - even though it's not hte best idea (transform would be better), I don't see why it wouldn't work. I actually was able to configure security for any key I wanted.


    Author Comment

    this is exactly what i did, but it gave me a mixed results, some users in a specific computers can stop the server and some can't.
    i'm totally lost.
    but thank you for the help.
    LVL 40

    Assisted Solution

    by:Vadim Rapp
    on the computers where users were able to make the change when they shouldn't, I would verify the actual permissions in regedit, and tried to make the change by regedit manually. If they can't but still were able to change settings of the program, it only means that the settings are elsewhere. I would then use filemon or regmon monitoring writes during the change to find out where.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    by Batuhan Cetin Within the dynamic life of an IT administrator, we hold many information in our minds like user names, passwords, IDs, phone numbers, incomes, service tags, bills and the order from our wives to buy milk when coming back to home.…
    Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now