Windows Forum

Ask something
Discussion Locked

Win2K Policies

0 helpful
7 replies

by paladin46

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Somebody please help me! I have a Windows NT 4.0 domain and a Novell 3.12 (stop laughing) network that my users log into. We have started getting Win2K Pro desktops and laptops in, and here is the problem. When my users login they are executing bothNT and Novell login scripts, some of these scripts make registry mods. My users have the Registry blocked the the policy but the login scripts still run fine on Win9X PCs. On the Win2K PCs we get errors because the users don't have rights to modify the registry. What I want is to enable the login scripts to make whatever mods are needed but still keep the Registry off limits to users, so they can't install apps or run regedit. Right now we add the Domain account to the Administrators group on the local Win2K PC but that gives users more power over their PCs than we want. What do I do?

7 replies

by erikdr

Well I don't tend to laugh on the NetWare 3.12 choice (if it ain't broke don't fix it) but by the apparently thoughtless switch between W9x and W2K and then expecting the security caveats to be the same!

In my view, W9x is as unsecure as hell andthe policy to block registry edit for W9x is only a fake; it does block REGEDIT and so on but it doesn't block a program modifying the registry. This is by design by MS, they warn for this. W2K _is_ secure in this sense.

The only valid design with W2K (and NT) to make 'essential'registry changes is by a software distribution system like ZENWorks or SMS, whose agent runs under a service account.

However I wonder whether the changes done in your logon script are of such a serious nature that they require essential changes. There are grades in the W2K policy to allow simple changes in the User hive of the registry while blocking more serious changes and blocking Regedit. Otherwise e.g. IE simply cannot run, it saves quite some settings in the registry while a user is busy. Also there's an alternative way to block registry editing in a granular way in W2K: by setting ACL's on all relevant registry hives.
So in summary:
a) Try to finetune the policy so that the changes in the logonscript (if really needed) are allowed.
b) If that fails, try ACL's (and keep regedit removed, the logon script can use VBScript or so)
c) If all else fails, and the functionality is really needed, try swdistribution like WinInstall (cheapest), ZENWorks or SMS.

Hope this helps,

/ The Netherlands

by carlsgaardp

You need to look at WIN2k SERVERS with Active Directory and Group Policies. Its a long road.... I Know.

by bill_beach

The only way that I can think of accomplishing this is through the Security/Permissions option in REGEDT32. By default the local Everyone group has read permission to the registry. If you know which key is being modified, or even a hive within the key, you can change the permissions on it giving Everyone full control, while not allowing them to run registry editing tools through your exisiting policies.

by paladin46

From what I'm told by the individual that writes the login scripts, this would not work because we would need to keep changing which keys get modified. But thanks for trying.

This discussion is closed to new replies.