Windows Forum

Ask something
Discussion Locked

Policy question

0 helpful
5 replies

by rgrowcock 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Is it possible, using the policy editor function of NT, to restrict a user from changing the shares on his computer when he has local administrator rights? The backup software I use requires that the source drive be shared, which I have done. However, unknown to me, the user has removed the admin share from that drive and the backup won't run.

My main problem is that several of the software programs that are used daily by each user requires local admin rights to work correctly. I have contemplated using creating a Policy and using that, but don't know if that will work for me. Or if I even know exactly how to do it in the first place.

My network is mixed NT and W2K Pro with NT 4.0 DCs. Any thought will be appreciated. Roger

5 replies

by smithjj

In Unix, the answer would be the "sticky bit", bit which allows user X to run a program as user Y. I would examine the policy capabilities of NT and W2K to see if this is possible.

If not, I'd look to run these programs as another user, remotely.

Another approach is to give the User admin privilege and then disable the network sharing capability. Rename or disable the network capability.

by rgrowcock

Unfortunately, I have to give these users Admin privileges for their programs to function properly and they have to run locally. Can you point me to the network sharing capabiltiy in another response? The only way I can directly respond to your question is by rejecting it. In the mean time I'm looking into answer 2 that mentions the hidden shares. Thanks!

by gigelul

With policies editor you can force restoring at the computer restart these admin share.
System Policies\Default Computer\Windows NT Network\Sharing\Create hidden drive shares(workstation).
To restrict remove shares, in this moment I don't know. I will try.

by rgrowcock

I ended up creating a hidden share for each computer and this is working fine. These are not deletable and will work for my purpose. Thanks for the response. Roger

This discussion is closed to new replies.