How to configure settings on a limited account.

[elkinm]

At work we want to move people from local admins to prevent them from messing up their systems and make them power users.

The problem is that power users are ridiculously limited.

The first thing is that I cannot even change the power management on the accounts and the system turns off monitor or goes into standby every 15 minutes and they cannot do anything about it. Plus the system locks when coming out of standby which is more annoying.
They also cannot turn off the visual effects from system properties or disable system restore which may be more administrative, but useless for us nonetheless. They cannot do as much as repair/enable their network connection if they needed to.
A bunch of other small system settings that they cannot do which are account based so I cannot change them form an administrator account.

Then come the serious problems, with some programs not having the correct permissions for some files so they don't work right or can't access the registry so they don't work right.

The first thing I would like to do is to elevate to administrator while in a limited account so I can at least configure the computer to what it should be. But really I would like the Power User to be quite a bit more powerful.

I have not messed around with users for a very long time but I thought they were at lease usable.

I would expect power users to have access to all programs on the system and all files unless specifically locked. They should be able to install basic programs unless maybe they modify critical sections of the registry or critical folders like /system32.

There has to be a way to at least configure as system to act and look like you want it, something I think even the Guest account should have.

Another question is how I can configure a generic account and save it as default so all other accounts look and act exactly like that, but I also need to make sure all users can change any settings specific to that account.

Thanks

 

[stash]

Ok, first....Power Uses are not really limited users. Power Users are users that haven't made themselves administrator yet. And it is pretty easy for a PU to elevate themself.

Now that that's out of the way, have a look at Aaron Margosis' site on LUA. He focuses a lot on how to work around the niggling problems in XP that prevent people from running as a standard user. Things like the clock, power management, etc.

http://blogs.msdn.com/aaron_margosis/

 

[elkinm]

Thank, I am looking though the website. The most promising part so far is the MakeMeAdmin script, but that is still a manual way to get around the problem not a real fix. I would still need to do it on every system with a new account.

Can you tell me how to elevate Power Users to near Administrator status like you mentioned, so they could do anything by the most critical tasks.

The best option is still to somehow save the default setup so it can be set once and forget it.

Thank again.

 

[stash]

Can you tell me how to elevate Power Users to near Administrator status like you mentioned, so they could do anything by the most critical tasks

That's not what I meant. I mean that a malicious power user can make himself an admin on the box, permanently, with not too much difficulty. And no, I am not going to post how to do that in a public forum, but if you really want to know, it's fairly easy to figure out/find.

The blog covers most of the issues you listed in your first post, and you can use tools like filemon and regmon to figure out what permissions apps need to run properly. Then you can grant those specific permissions, rather than make everyone an admin. Using these things makes it pretty easy to run as a standard user on XP.