W2K PowerUser and Admin Rights

hey gang i'm in the middle of a nt -> w2k pro migration for our users(new machines with fresh install) and the problem and trend we seem to be having is the amount of apps that require the user to be a power user or admin on the local machine.

my techs will load the apps for the user roll out the machine, but the app won't run unless the user is a poweruser or admin on the local machine which is what we don't want to have to do.

some of the apps that are giving us this problem are crystal reports, oracle, power point org charts, and some custom app that we use.

is anyone else seeing this problem?

We let 'em be power users of their own machines but they can't do much in the domain.

Quote:

---

Originally posted by LPetrarca:
We let 'em be power users of their own machines but they can't do much in the domain.

---

The same here. User status is so limited that you will be getting calls from everyone every five minutes. This gets old very fast. Setting as power user gives them authority over their domain(their computer) not the main domain.

Are the machines NTFS or FAT? IF they are NTFS you may be able to find the locations that need to be written to but if they are FAT then it is system commands that must change, and they need power user status on the local machine.

Quote:

---

Originally posted by cyberhh:
Are the machines NTFS or FAT? IF they are NTFS you may be able to find the locations that need to be written to but if they are FAT then it is system commands that must change, and they need power user status on the local machine.

---

they're all ntfs. i just hate to have to give the user access to any part of the machine that i know will start generating tech support calls because they started playing with stuff.

Quote:

---

Originally posted by storm:
they're all ntfs. i just hate to have to give the user access to any part of the machine that i know will start generating tech support calls because they started playing with stuff.

---

But that's why we have jobs!!!!! The entire reason for our existence!!!!!!!

Quote:

---

Originally posted by LPetrarca:
But that's why we have jobs!!!!! The entire reason for our existence!!!!!!!

---

i enjoy your enthusiasm for the job but believe me we have enough around this joint to justify our existance.

we're doing the same thing for a company out here in texas, what we had to do is find all the places these apps wanted control with and set permissions for them, things like subfolders of program files directory or certain registry keys. all of that takes alot of testing by our certification lab.

We were having the same problems as well, In the PU Group Properties we put

XXX-XX\Domain Users,
NT Authority\Authenticated Users,
NT Authority\INTERACTIVE.

These 3 groups solved the permissions problems and gave us back our time…

--------------------------------------------
What I need is a list of specific unknown problems we will encounter
:rolleyes:

As I said - check the difference between the rights of the two groups and change the required directory permissions accordingly.
check this http://support.microsoft.com/support.../q244/6/00.asp
for more information.

Also this article gives you the default NT 4.0 permissions - you can compare the two articles to see what changed: http://support.microsoft.com/support.../q148/4/37.asp

great feedback, i appriciate all the posts, thanks.....

Depending on the app, isn't it possible to assign rights and priviliges to the software itself while withholding rights to the users?

I remember installing something recently on a 2k box that wanted a user account for its process.... Can't remember what the damn thing was called becaue it hasn't caused me any problems since....