A question for network administrators

[Dark]

Hi. I got a problem. Acer scanners refuse to function if the user is a not administrator, even power users won't do it. Called Acer support, they suggest that i change the OS...can u believe that? What a morons. So I thought I might get some help from u guys, I don't wanna give users administrator right so they can scan and also screw the workstation and all my security scheme.
Thx

 

[damien6]

What OS are you using? (Unix, NT, Win2K, etc..) How is that scanner hooked up to the network and what type of network implementation do you have?

Off hand, I say create a user group for that scanner w/limited user rights and let all the user/PC who needs to access that scanner a member of that user group.

 

[Dark]

I'm using a Win2k Server as a DC. The workstations are using win2k pro. The scanners are connected to the workstations. There are no local users. They connect all to the DC. What do u think?

 

[KB]

I know I am not any help, but I think you need a new scanner.

 

[MulLa]

Taking a guess here....

Would permissions to access the object "scanner" set correctly?

 

[DaveJ]

What you might do is run a registry monitor util and find out exactly what the scanner accesses when you scan under Admin rights. You could then give access to just those resources (reg keys an/or files). Netscape used to do weird things under Win2k without admin rights (nothing serious, just nitpicky stuff) and I used a similar technique to figure out what it was doing...

Dave

 

[Dark]

MulLa: On the workstation or on the DC?

Dave: What registry monitor did u use?

 

[Jhereg]

As a workaround... have you tried giving them a local poweruser account ?
My thought here is since it is a local resource, you might want to access it locally.
Yeah its a pain for them to relog in as a local user , but it might bide you time till you find a better solution

 

[damien6]

Dark - "Acer scanners refuse to function if the user is a not administrator, even power users won't do it."

Which administrator are you talking about, local workstation admin or the domain admin? Log into the DC as the domain admin and share that scanner to specific group. Then you need to create a user group who has user right to that scanner and specify the level of access you want to give to that group.


"The scanners are connected to the workstations"

How many scanners are connected to what numbers of workstation?


"There are no local users. They connect all to the DC."

Are you saying that all the workstations are accessed from the DC and all the users that wants to acess anything in that network do it from the DC? I think you most likely meant that the local users of the workstations need to be logged in to access the network. The local workstation admin + the DC admin are not the same even if you use the same name/password. (which in itself isn't that great of an idea)

 

[Rogue]

Go to Control Panel>Users and Passwords>Add and enter their username and Domain and assign their Domain login to the local Power Users group, or maybe even the Local Administrator group. This will not elevate their permissions on the network, only on the local workstation.

 

[BearX00]

Try making them Local administrators, that will probably work because they will be administrators for that computer which is what it needs

 

[Dark]

Thx for ur suggeestions all.
Jhereg: Power users can't make it work either.

Rogue: That will permit them to install apps and junk on their workstation and I won't to avoid that.

Damien: 1) I was talking about the local admin. 2) Each workstation has a scanner attached to it. 3)I mean't that all the accounts are created on the DC, there is no local account for the users.

I'm not critisizing any of ur suggestions, just making things clearer