Admin Rights

Hi Experts

All our users have local admin rights on their PC's. This has been the case for years and now we are trying to remove admin rights from all PC's but as soon as we do this, Outlook stops working (Error message: Cannot open Outlook), and the backround pic stops working which is being done  via Active Directory.

As soon as we give them admin rights again, everything works again.

How do we get around all of this?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Krzysztof PytkoSenior Active Directory EngineerCommented:
Looks like there is a problem with write/delete permissions to some folders or registry keys. You need to track on one workstation where Outlook saves/deletes temporary files and check if granting users modify permission would solve this problem.

Then you can try deploy this solution to rest of your clients.

iamdieterAuthor Commented:
And why would the backround pic not display? We deploy that via GPO
How many users do you support?

Could you rename their profile, change permissions, then setup their profile again while they only have read only, this will then use the correct folders for their profile.

Otherwise change them to read only, use FileMon from sysinternales and see where its failing to write then add permissions for them, this is a better option if you have loads of users you can troubleshoot one then use GPO to fix the rest.
Your Guide to Achieving IT Business Success

The IT Service Excellence Tool Kit has best practices to keep your clients happy and business booming. Inside, you’ll find everything you need to increase client satisfaction and retention, become more competitive, and increase your overall success.

Via what settings in the GPO? A script? Or admin templates etc? I think you'll need to be more specific with background workings for the pic, and then it may become clear why elevated priviledges are required for it to work... (and if a script is involved, it would be very helpful if you could post it's contents).

Many thanks,

iamdieterAuthor Commented:

We deploy via a script which just removes the current user logged in, from the local admin group. I suspect that because the apps were installed when users were still part of local admin group, it gives a problem when you remove them.
Sorry I meant what method was used to set the background itself, as there should be no requirement for this to have elevated privs...

I find it hard to imagine that because the users were in the admin group, that apps such as Outlook will no longer work without... Most apps require admin rights to install the software in the first place, but have no requirement for the rights to continue after the installation is complete.

Have you tried doing it manually on a machine and re-testing, just to see if your script is having some weird side affect?
iamdieterAuthor Commented:
Yes I have. removing a user from the admin group, causes Outlook, etc not to work. Background was deployed via GPO
I'd advise installing a tool like filemon on one of the machines in question, and running it whilst trying to open Outlook without the admin priviledges, as this should show you what specific action is being blocked somehow.

As I think someone else said above, it's possible that as the users had admin rights for some time, they've changed some kind of file location settings in their Outlook settings that is now storing something somewhere you don't have access to without the admin privilidges.

Nearly all software needs installing with local admin rights, and does not (as standard) require administrative rights to use from that point on, so this must be some custom setting somewhere...



Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.