Windows Forum

Ask something
Discussion Locked

NT Profiles are driving me nuts.

0 helpful
12 replies

by public 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Profiles in general, I find very damned confusing. I?m reading up on them now but i cant find the answers i need. Maybe someone knows.....

We're planning a rollout to win2k. We used to have win98 connected to a winNT 4.0 server. Under win98 we installed everything with an administrator account that had access to a software dump. Then we logged on as the person we were configuring it for and put the finishing touches. ALL the programs worked fine. The profiles matched perfectly.

Now on to win2k. We decided to do the same. Log on as administrator into the domain and install everything. Oh boy. Our BPCS IBM/as400 client access programs stopped working including other programs as well etc etc.

So we read in a SYSPREP whitepaper by microsoft that we should "Create a local user account with Administrator Privileges and log on as that user to install and customize applications, such as office 2000, business-specific applications and other applications or settings that will be common for all workstations" (because were going to use norton ghost to image our computers. we named this local user "installer" and did as Microsoft suggested.)
"Once you have customized the system, log off as that user and log back on as administrator. Then copy that user profile to the DEFAULT USERS folder.

Fine, we do that. But IBM BPCS still doesn?t work with a couple other programs. We are forced to make users into POWER USERS and we don?t want to do that, but right now we have no choice.

Does default user settings also go for administrators logging in? Will all the settings done with "installer" go for EVERY user logging in from now on?

Most importantly how can we make some programs work without making people power users? I've scanned many a web site and have yet to find anything.

Thanks for the help guys.
-G
NTadmin
MS will pay for its arrogance one day :)

12 replies

by gmscne

I would try this:
Find out which files and/or directories that BPCS and the other programs write to, and then, as admin, give permission to Installer to modify those locations. It may work.

by beermonster

Oh Boy, sounds like you've been hard at it !! Okay; with win 9X, security wasn't a problem - mainly 'cos there wasn't any! anyone could log and do anything. This made things simple, but also caused problems as anyone (usually mr joe user) could do whatever they liked whenever they liked (and usually did). It was a support nightmare. Along comes NT, now a controllable level of security was available down to the individual file or registry key entry. Great ! except now every app you ran fell overif the person running it didn't have the relevant permissions on the files \ registry keys the app accessed. To cope with this, NT had fairly relaxed security. users could write and modify entries in hklm\software where most apps write their entries, and had a certain amount of control over the system directory. You still usually had to install as an admin, but once installed things generally went ok. As some apps wrote to the logged on users profile in HKCU, the old trick of copying over the ntuser.dat file to default users was used, every new user who logged on received a copy of the default users profile and thus the apps settings. The world was at peace, the birds sang... Well, almost. Unfortunately mr hacker took advantage of the relaxed security, as did mr joe user who was still able to load a certain amount of unwanted software. SO, along comes win2k - and Microsoft(perhaps after one security scare too many)decide to tighten up the security model, locking down both the registryand the system directory (among other things). I think you'll find it's this that is causing your problems. So, what to do ? 2 routes you can take. Firstly, you could apply the compatws.inf security template on your win2k professional machines. Thiswill alter permissions so that security on your win2k machines reverts back to the older (more relaxed) NT4 model.

by beermonster

Search for compatws.inf on technet for instructions on how to do this. The problem there is that you will be left with professional machines that are considered (IN MS's words) 'NOT SECURE'. The second option (my favourite) is to pin down PRECISELY which registry keys or files are causing the problem and ope them up as much as is required for the app to run. I've spent a lot of time doing this sort of thing lately, and a quick way to narrow down what the problem might be is to a) use regedt32 to open permissions on HKLM\software - see if your app runs. If so, look for entries in hklm\software specific to your app, and try opening only those up. b) open up the winnt directory (and subdirectories) to everyone, try and run your app. If it runs, try different combinations of permissions on the subfolders to narrow it down. I think you'll find that either, or both, of the above will get your app working.

by beermonster

If you have trouble pinpointing exactly where the problem is (IE opening up hklm\software or the system directory solves the problem but you can't see what specific subkey, folder or file is the cause), I have a tried and tested method for tracking it down. As I've already written war and peace here you can mail me if you need more info on that darthurs@hotmail.com .once you've solved the problem, you can adjust permissions on your image machine or (for machines that are already out there) use a domain or OU specific group policy to open up the permissions (great touch that, Microsoft). again mail me if you need details of that. Hope it goes ok......

by public

FANTASTIC!! Now thats what I call an answer :) You are perfectly right, and in my heart of hearts, i knew that the registry/security settings was where my problem was. I was just LOATHE to even go there, and was looking for an easier way out. Lazy lazy me (actually i run around like a maniac during the day and i really really dont have any time to do any HARDCORE research). When you were explaining maybe tracking the registry changes , it brought to mind Norton software that "follows" a program install and records EVERYTHING done to the computer. I believe it was called Norton CleanSweep or something of a sort (for anyone who needs to follow registry changes in a program installation). Thank you very very much BeerMonster, and i wish i can buy you a keg or two on me :)

Bottoms up!!

~ ~
( o )o)
( o )o )o)
(o( ~~~~~~~~o
( )' ~~~~~~~'
( )|) |-.
o| |-. \ o| | \ \
| | | |
o| | / /
| |." "
| |- '
.========.

by mad max

A Good resource site www.jsiinc.com...

We use a snapshot program such as Wininstall or (as we are using ZEN works) Snappshot to gain info on which registry keys are being changed and then amend the rights on the awkward areas of the registry.BTW if power users is a solution then it is almost certainly registry security that is foiling you.

by dcadmin

Your installation is fine.
What the deal with some apps needing people to be power users has to do with whether the application is certified for windows 2000. In the following explanation provided in MS Technet under security is the rights of different types of users. If you need to run the application on windows 2000 you should make the user a power user (sorry) and then provide a security policy that locks items down that you don't want users doing. The default user profile is only used once to create a user profile in the beginning, you have the option to not allow changes, but that is up to you. After the first login though each user then goes off their created account.

Here is the MS explanation:
Permissions of Security Groups

Windows 2000 includes a number of preconfigured groups including the following:
? Guests: This group allows occasional or one-time users to log on to a workstation?s built-in Guest account and be granted limited abilities. Members of the Guestgroup can also shut down the system. The built-in guest account is disabled by default.
? Users: Members of this group (normal authenticated users) do not have broad read/write permission as they did in Windows NT 4.0. These users have read-only permission for most parts of the system and read/write permission in their own profile folders. Users cannot read other users? data, install applications that require modification of system directories, or perform administrative tasks.
? Power Users: Members of this group have all the access permissions that Users and Power Users had in Windows NT 4.0. Power Users have read/write permission to other parts of the system in addition to their own profile folders. Power Users can install applications and perform many administrative tasks. If you are running applications that have not been certified for use with Windows 2000, users will need to have Power User privileges.

This discussion is closed to new replies.