Windows Forum

Ask something
Discussion Locked

Here's a good one !!!

0 helpful
9 replies

by izz 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a smart user that has done the following. I have an NT4.0 domain, which is working very well thank God. I am migrating some of the workstations that meet the Win2k requirements. One user has done the following. He went to local security settings, local policy, User Rights Assignment and chose the " Access this computer from Network" and removed all options from it (Everyone, Administrator, Power User, and whatever). This means that I can?t ping, manage or do whatever to him. This is good security actually, but even an administrator still must have the choice to do his job. Is there a way, rather than fighting with him to override this problem, with the help of existing NT domain. Can old group policy solve this issue?

Any help would be appreciated.

9 replies

by computechie

If you create a policy for the domain from your servers, it always overrides the workstations local policies. An old group policy probably would solve this for you. If I were you, I'd make sure you set your users to resticted users so that they cantmake these kinds of changes to the PC's. As I've found out, the more things that users can do to a PC, the more they will do, so making sure they can't do administrator tasks, you'll have a much easier time doing your job. Were currently implementing Windows 2000 and finding out more and more all the time about how much tighter you can make your security, I'm sure you'll be pleased with your Win2K transition. I hope this helps you out, if you need any more assistance email me at computechie99@yahoo.com and I'll see what I can do.

by izz

Thanks for wishing me luck for migrating to W2k, I myself like it alot. But I so far feel that it is kind of limited without the backend of a W2k Server.

by dmiles

I donot think that it is good security that an administrator has been locked out of a machine,lack of security has allowed someone to perform a task that will create a problem if you donot look at the bigger picture,either this guy is pissed off or he wants your job and it would behoove you to get close to him before he starts to show this to anyone of importance.
Computertechie gave you an option and it was totally dismissed as you were thinking of the migration and not the task at hand.
This would be considered a breach of security,and hoefully you can resolve this issue.Good Luck

by izz

Actually this guy is in the IT, but he is playing smart on me, that is all, but still it is a good content for a question.

by duskos

If that guy is in IT, then he does not have any need for your support and you don't have any business to do on his workstation.
We have some rules in our company and perhaps you should make some of yours and try to communicate those across your company:

1. PC's that employees work on are property of the company. They were given to employees so that they can complete their work and not to amuse themselves.

2. IT department is responsible for hardware, software and data.
a) If hardware fails it will be replaced.
b) If software fails it will be reinstalled either from original media or from image
c) IT is responible only for the data stored on server. Data stored on workstation is responsibility of the user.

by shmaltz

A normal user (by normal I mean that he is NOT IT, added to the local machine as a regular user) can NOT modify the local policy on a windows 2k machine. He is restricted by default. Only if he is part of the administrator group he can modify the local security settings.

This discussion is closed to new replies.