Question Locked

access to local disk - business server 2003

0 helpful
10 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello

Our company takes care of a network in another company with approx. 50 workstations... Recently they have decided to install an application on every workstation that needs to write files on local disk (which cannot be done because users don't have that permission)...

so the question is: how can i change users permissions so the can have "write" permission to whole local disk.

Please try to explain it as simple as possible, I'm new to this server things :)))

10 replies

by colmgdonnelly

Ok firstly you should under no circumstances give users full write permissions to their local harddisks. Are the workstations part of a workgroup or a domain? If they are not members of a domain you should probably create one and use group policies to distribute and install your software

by maniacman

A true client/server app would not require security to be compromised by requiring that users be local admins of their PCs'. I'd be very worried about granting users full control over their PCs' because they will screw up their machines and it's not a matter of if, it's a matter of when.

by ben.rattigan

Do you want users to have access to the entire local disk or just specific folder(s) on it?

What I would do is create a user group on your Windows server (assuming it's windows your using) and make all those users running this application a member of this security group. Then give this security group access to the local disk/folder(s) as required.

1. From your domain controller server in Active Directory for Users and Computers you need to select Action > New > Group.
2. Enter a name for the group (maybe use a short name of the application they are using to easily identify its purpose)
3. Group scope should be Global and Group Type should be Security.
4. Click OK.
5. Locate the group you have just created in Active Directory, it will be in Users.
6. Double click on the group to display its properties.
7. Enter a brief description.
8. Click on the Members tab.
9. Click Add and enter the username(s) of those users you need. (i.e. jsmith; dfred) seperate user names with ; (semicolons).
10 Click OK.
11. Now you can go to each PC, log on as administrator and locate the folder(s) where access is required.
12 Right click the folder and select Sharing and Security
13. Click on the Security tab and click Add, enter the name of the security group you created on Active Directory and click OK and select the permissions as required.

You can use group policy editor to create this if you want.

by jan.prosen

this is very helpful, thanx..
But I belive I would still have to do this manually for all 50 PCs, isn't there a way to do it from server?

by ben.rattigan

You can do this with Group Policy Objects and I would seriously go and get a book about Windows GPO before doing anything.

Windows Server 2003 Inside Out by William R Stanek from Microsoft Press is a good all round book for Windows Server 2003.

Group Policies can be applied to Users and Computers in Active Directory forcing certain settings to a PC or user account such as desktop themes, deploying MSI applications, setting Internet Explorer and so on. You can create multiple policies which can be applied to specific containers on Active Directory and the entire domain.

If you haven't go the Group Policy Management console installed then do this first, otherwise you access GPO from Active Directory, see here http://technet2.microsoft.com/windowsserver/en/library/357a771e-05d1-48bf-8855-5d29bf91bb201033.mspx?mfr=true

by maniacman

I won't go into details or give you a lecture on how GPOs' work, but I do recommend you learn about Group Policy Objects and what you can do with them.

by naderihadi

Thanks to all description.
I appreciate if someone could just tell how users could be configured to access their C drive via GPO, so that it saves us time going round PC's I appreciate. I have read all the items and found nothing.

Thanks to all

This discussion is closed to new replies.