A Windows XP help forum. PCbanter

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Go Back   Home » PCbanter forum » Microsoft Windows XP » Security and Administration with Windows XP
Site Map Home Register Authors List Search Today's Posts Mark Forums Read Web Partners

Group Policy Editor



 
 
Thread Tools Display Modes
  #1  
Old January 27th 08, 01:46 AM posted to microsoft.public.windowsxp.security_admin
ed black
external usenet poster
 
Posts: 1
Default Group Policy Editor

I run xp media center and the user accounts can't run installed programs. I
went to the group policy editor in an admin account and clicked the user
configuration,software configuration and there is no software installation
node like the help files say there is. I don't want to let guests run in an
admin account. And I want to run programs that access the web from a limited
account for internet security purposes.

What can I do to allow user groups to access software programs?
Ads
  #2  
Old January 27th 08, 11:46 PM posted to microsoft.public.windowsxp.security_admin
Lanwench [MVP - Exchange]
external usenet poster
 
Posts: 1,547
Default Group Policy Editor

ed black ed wrote:
I run xp media center and the user accounts can't run installed
programs. I went to the group policy editor in an admin account and
clicked the user configuration,software configuration and there is no
software installation node like the help files say there is. I don't
want to let guests run in an admin account. And I want to run
programs that access the web from a limited account for internet
security purposes.

What can I do to allow user groups to access software programs?


I'm presuming you don't mean *all* installed programs, surely. If so,
someone has mucked with things very badly and you may have a reinstall in
your future.

If you mean *some* programs - group policy isn't where you do stuff like
this, especially as you aren't on a domain. Don't do anything in there.

Instead, you need to find out what permissions the specific problem apps is
expecting (in the registry and file system) and change the permissions
accordingly.

Google for "Process Explorer" - a Sysinternals tool now owned by MS - and
see whether it helps you identify the locations. Log in as an admin, but
launch Process Explorer using runas & specify an admin account - then try to
launch the app.

Oh - and don't forget to complain to the product developers about their
sloppy code. Users should not need admin rights to run desktop software.


  #3  
Old January 28th 08, 12:14 AM posted to microsoft.public.windowsxp.security_admin
ed black[_2_]
external usenet poster
 
Posts: 8
Default Group Policy Editor



"Lanwench [MVP - Exchange]" wrote:

ed black ed wrote:
I run xp media center and the user accounts can't run installed
programs. I went to the group policy editor in an admin account and
clicked the user configuration,software configuration and there is no
software installation node like the help files say there is. I don't
want to let guests run in an admin account. And I want to run
programs that access the web from a limited account for internet
security purposes.

What can I do to allow user groups to access software programs?


I'm presuming you don't mean *all* installed programs, surely. If so,
someone has mucked with things very badly and you may have a reinstall in
your future.

If you mean *some* programs - group policy isn't where you do stuff like
this, especially as you aren't on a domain. Don't do anything in there.

Instead, you need to find out what permissions the specific problem apps is
expecting (in the registry and file system) and change the permissions
accordingly.

Google for "Process Explorer" - a Sysinternals tool now owned by MS - and
see whether it helps you identify the locations. Log in as an admin, but
launch Process Explorer using runas & specify an admin account - then try to
launch the app.

Oh - and don't forget to complain to the product developers about their
sloppy code. Users should not need admin rights to run desktop software.





Ok thanks Lanwench! You're right, it's not all apps, just some apps. I'll
try what you suggest. And I'm frustrated with the developers because when I
go to 'Help and Support' from the start menu, it explains all about the Group
Policy editor and how to allow software permissions in user configuration,
then surprise, surprise, it's not set up on xp media center. What a waste of
a couple hours fooling around with that. I trusted that the help/support
center installed with the OS would refer to my OS; and that's not the case
here. If I knew who to complain to I would, it's just that sifting through
all the forums, newsgroups, technets is tedious and I can't seem to find the
'complaints department'
  #4  
Old January 28th 08, 01:53 AM posted to microsoft.public.windowsxp.security_admin
ed black[_2_]
external usenet poster
 
Posts: 8
Default Group Policy Editor

why am i not surprised that this newsgroup is not firefox friendly? I tried
to reply to this thread in firefox and got nowhere. So here I am in ie7
hoping I don't get the dreaded 'needs to close encountered problem' treatment

Anyway, the 'process explorer' app doesn't look like it will solve anything
for me. And if I need to edit registries and write code for the OS, I'm not
going to be able to do it.

Why can't limited accounts and guest accounts run software I install at the
admin level?

If they can't install their own programs and can't run programs installed in
admin, then what good are limited and guests accounts?

I can run MS office apps and ie7 and firefox and those things, but when I
try to run a game or 3d party software, I get the 'can't write to so and so'
message.

I'm no computer programmer or IT guy, but i'd really like to use the limited
and guest accounts. Is there an 'easy' way to make it work besides editing
registries and writing code for xp media center?


  #5  
Old January 28th 08, 04:26 AM posted to microsoft.public.windowsxp.security_admin
Shenan Stanley
external usenet poster
 
Posts: 10,523
Default Group Policy Editor

prior messages not relevant to my comment - snipped

ed black wrote:
why am i not surprised that this newsgroup is not firefox friendly?
I tried to reply to this thread in firefox and got nowhere. So
here I am in ie7 hoping I don't get the dreaded 'needs to close
encountered problem' treatment

snipped

Microsoft Newsgroups: Frequently Asked Questions
http://www.microsoft.com/communities...sgroupfaq.mspx

How to Configure Outlook Express for Internet News
http://support.microsoft.com/kb/171164

How to Subscribe to Newsgroups in Outlook Express
http://support.microsoft.com/kb/171190

A little more detail...
http://www.michaelstevenstech.com/ou...snewreader.htm

If you want to search for older posts than you may choose to keep on your
computer...
http://groups.google.com/

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html


  #6  
Old January 28th 08, 12:51 PM posted to microsoft.public.windowsxp.security_admin
Lanwench [MVP - Exchange]
external usenet poster
 
Posts: 1,547
Default Group Policy Editor

ed black wrote:
"Lanwench [MVP - Exchange]" wrote:

ed black ed wrote:
I run xp media center and the user accounts can't run installed
programs. I went to the group policy editor in an admin account and
clicked the user configuration,software configuration and there is
no software installation node like the help files say there is. I
don't want to let guests run in an admin account. And I want to run
programs that access the web from a limited account for internet
security purposes.

What can I do to allow user groups to access software programs?


I'm presuming you don't mean *all* installed programs, surely. If so,
someone has mucked with things very badly and you may have a
reinstall in your future.

If you mean *some* programs - group policy isn't where you do stuff
like this, especially as you aren't on a domain. Don't do anything
in there.

Instead, you need to find out what permissions the specific problem
apps is expecting (in the registry and file system) and change the
permissions accordingly.

Google for "Process Explorer" - a Sysinternals tool now owned by MS
- and see whether it helps you identify the locations. Log in as an
admin, but launch Process Explorer using runas & specify an admin
account - then try to launch the app.

Oh - and don't forget to complain to the product developers about
their sloppy code. Users should not need admin rights to run desktop
software.





Ok thanks Lanwench! You're right, it's not all apps, just some
apps. I'll try what you suggest. And I'm frustrated with the
developers because when I go to 'Help and Support' from the start
menu, it explains all about the Group Policy editor and how to allow
software permissions in user configuration, then surprise, surprise,
it's not set up on xp media center.


MCE is odd, indeed.

What a waste of a couple hours
fooling around with that. I trusted that the help/support center
installed with the OS would refer to my OS; and that's not the case
here. If I knew who to complain to I would, it's just that sifting
through all the forums, newsgroups, technets is tedious and I can't
seem to find the 'complaints department'


Not sure what you searched for in Help & Support - even *outside* of MCE,
this would not be a group policy issue. If you google for "limited user"
application error etc you will find a lot.

You ought to be complaining to the doofuses who wrote the third party
applications which your end users cannot run. :-)


  #7  
Old January 28th 08, 12:56 PM posted to microsoft.public.windowsxp.security_admin
ed black[_2_]
external usenet poster
 
Posts: 8
Default Group Policy Editor



"Shenan Stanley" wrote:

prior messages not relevant to my comment - snipped

ed black wrote:
why am i not surprised that this newsgroup is not firefox friendly?
I tried to reply to this thread in firefox and got nowhere. So
here I am in ie7 hoping I don't get the dreaded 'needs to close
encountered problem' treatment

snipped

Microsoft Newsgroups: Frequently Asked Questions
http://www.microsoft.com/communities...sgroupfaq.mspx

How to Configure Outlook Express for Internet News
http://support.microsoft.com/kb/171164

How to Subscribe to Newsgroups in Outlook Express
http://support.microsoft.com/kb/171190

A little more detail...
http://www.michaelstevenstech.com/ou...snewreader.htm

If you want to search for older posts than you may choose to keep on your
computer...
http://groups.google.com/

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html





thanks shenan I will stick with using MS Outlook for email and not outlook
express and I want to look at the news group in the browser


Looks like I derailed my own post any way back on topic I can't find
anywhere to answer the question about how to allow users to access 'some'
programs that the admin installs. Nowhere is there a place to send feedback
or submit bugs to Microsoft.

Will someone please help
  #8  
Old January 28th 08, 01:00 PM posted to microsoft.public.windowsxp.security_admin
Lanwench [MVP - Exchange]
external usenet poster
 
Posts: 1,547
Default Group Policy Editor

ed black wrote:
why am i not surprised that this newsgroup is not firefox friendly?


You wouldn't use Firefox to access a *newsgroup* - it's a web browser.
Thunderbird is a newsreader. Don't use the crummy web interface to access
these groups at all and you'll be a lot happier. See below.

I tried to reply to this thread in firefox and got nowhere. So here
I am in ie7 hoping I don't get the dreaded 'needs to close
encountered problem' treatment

Anyway, the 'process explorer' app


My apologies - I was in autopilot mode...sorry! It was a lot eaiser to
remember the product names before Sysinternals was absorbed into the
collective. It's actually Process *Monitor* -

http://technet.microsoft.com/en-us/s.../bb896645.aspx


doesn't look like it will solve
anything for me. And if I need to edit registries and write code for
the OS, I'm not going to be able to do it.


Ain't no code to write. However, you will indeed need to edit the registry
and you will indeed need to edit some NTFS permissions in the file system.


Why can't limited accounts and guest accounts run software I install
at the admin level?


Because the people who wrote the software are lazy eedjits? What do the
developers say when you ask them? If their answer is "Make the users admins"
then tell them to go pound sand.


If they can't install their own programs and can't run programs
installed in admin, then what good are limited and guests accounts?


There should be no"guest" enabled if you value your security, and Limited
User means just that - they *shouldn't* be installing software, etc.

Limited users should be able to *run* programs you installed as an admin.


I can run MS office apps and ie7 and firefox and those things, but
when I try to run a game or 3d party software, I get the 'can't
write to so and so' message.


See "eedjit" comment above.

I'm no computer programmer or IT guy, but i'd really like to use the
limited and guest accounts. Is there an 'easy' way to make it work
besides editing registries and writing code for xp media center?


Again, there's no code to write - and check out the correct Sysinternals
tool I mentioned above. Sorry for the confusion; I was multitasking.

Re your access to the groups:

Try using a news client, such as Forte Agent, Thunderbird, or even Outlook
Express, rather than the pretty clunky web interface to the newsgroups. It's
a lot easier to do nearly everything that way. You can mark messages to be
watched, filter the views so you can see replies to your posts easily, and
search.

The Microsoft public news server is msnews.microsoft.com and you can
subscribe to as many groups as you like; no authentication is required.

The following is from a post by MVP Malke ...

-------------------------------------------------------
Here's information on Usenet and using a newsreader:

http://www.elephantboycomputers.com/page3.html#12-09-02 - a brief
explanation of newsgroups
http://michaelstevenstech.com/outlo...ssnewreader.htm
http://rickrogers.org/setupoe.htm
http://support.microsoft.com/defaul...wto/default.asp
- Set Up Newsreader

http://www.dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html
http://aumha.org/nntp.htm - list of MS newsgroups
microsoft.public.test.here - MS group to test if your newsreader is
working properly
http://www.mailmsg.com/SPAM_munging.htm - how to munge email address
http://www.blakjak.demon.co.uk/mul_crss.htm - multiposting vs.
crossposting

Some newsreaders for Windows
http://www.forteinc.com/agent/index.php - for Forte
http://www.mozilla.org (Thunderbird does newsgroups)
http://gravity.tbates.org/

-------------------------------------



  #9  
Old January 28th 08, 02:02 PM posted to microsoft.public.windowsxp.security_admin
ed black[_2_]
external usenet poster
 
Posts: 8
Default Group Policy Editor



"Lanwench [MVP - Exchange]" wrote:



Not sure what you searched for in Help & Support - even *outside* of MCE,
this would not be a group policy issue. If you google for "limited user"
application error etc you will find a lot.

You ought to be complaining to the doofuses who wrote the third party
applications which your end users cannot run. :-)




Thanks for clarifying that sysinternal app. I'll look into that later.
I'll try to walk through the 'Help and Support' on the start menu

Open Help and Support
Pick a Help topic -- System administration
Security and administration tools
Overviews, articles, and tutorials -- Using Group Policy

"In an environment where you have one stand-alone computer or several
computers joined in a workgroup, you can still use Group Policy to customize
your computer.

To open Group Policy

Click Start, and then click Run.
Type gpedit.msc and then click OK.
When Group Policy opens, you will see two options in Local Computer Policy:
Computer Configuration and User Configuration. Computer Configuration allows
you to set policies that apply to your computer, regardless of who logs on.
User Configuration allows you to set policies that apply to each user who
logs on to the computer."


" To open the Software Installation snap-in
Open the Group Policy snap-in.
To assign software applications to computers, in the console tree
double-click Computer Configuration. To assign or publish software
applications to users, in the console tree double-click User Configuration.
Double-click Software Settings, and then click Software installation.
Where?

policy name Policy
Computer Configuration (or User Configuration)
Software Settings
Software installation"


And at the part where I get to 'Software Installation' it's not there.
I open up the Software Settings Folder and it's empty. It's a dead end.
Nothing to do in the 'Software Settings Folder'

I gotta run. I'll look at the process thing after work.

Thanks again Lanwench



  #10  
Old January 28th 08, 02:19 PM posted to microsoft.public.windowsxp.security_admin
Lanwench [MVP - Exchange]
external usenet poster
 
Posts: 1,547
Default Group Policy Editor

ed black wrote:
"Lanwench [MVP - Exchange]" wrote:



Not sure what you searched for in Help & Support - even *outside* of
MCE, this would not be a group policy issue. If you google for
"limited user" application error etc you will find a lot.

You ought to be complaining to the doofuses who wrote the third party
applications which your end users cannot run. :-)




Thanks for clarifying that sysinternal app. I'll look into that
later. I'll try to walk through the 'Help and Support' on the start
menu

Open Help and Support
Pick a Help topic -- System administration
Security and administration tools
Overviews, articles, and tutorials -- Using Group Policy


OK - bu why would you search for or pick that option? Again: this isn't a
policy issue at all. It's really no more useful in your situation than if
you searched for "how do I use Notepad.exe" :-)

"In an environment where you have one stand-alone computer or
several computers joined in a workgroup, you can still use Group
Policy to customize your computer.

To open Group Policy

Click Start, and then click Run.
Type gpedit.msc and then click OK.
When Group Policy opens, you will see two options in Local Computer
Policy: Computer Configuration and User Configuration. Computer
Configuration allows you to set policies that apply to your computer,
regardless of who logs on. User Configuration allows you to set
policies that apply to each user who logs on to the computer."


" To open the Software Installation snap-in
Open the Group Policy snap-in.
To assign software applications to computers, in the console tree
double-click Computer Configuration. To assign or publish software
applications to users, in the console tree double-click User
Configuration. Double-click Software Settings, and then click
Software installation. Where?

policy name Policy
Computer Configuration (or User Configuration)
Software Settings
Software installation"


And at the part where I get to 'Software Installation' it's not
there.
I open up the Software Settings Folder and it's empty. It's a dead
end. Nothing to do in the 'Software Settings Folder'

I gotta run. I'll look at the process thing after work.

Thanks again Lanwench


No problem. I think you're correct in that there's an error in the Help &
Support (without a domain, you technically don't have group policy - you
just have a local policy).

However, this is not a group policy thing - you don't even have group policy
because you aren't on a domain. You have a local policy, and you do NOT want
to mess with it - you'd end up locking yourself out too.

This is a permissions issue, plain and simple - in the file system & perhaps
also in the registry. And it's due to the developers.


  #11  
Old January 28th 08, 11:23 PM posted to microsoft.public.windowsxp.security_admin
ed black[_2_]
external usenet poster
 
Posts: 8
Default Group Policy Editor



"Lanwench [MVP - Exchange]" wrote:

ed black wrote:
why am i not surprised that this newsgroup is not firefox friendly?


You wouldn't use Firefox to access a *newsgroup* - it's a web browser.
Thunderbird is a newsreader. Don't use the crummy web interface to access
these groups at all and you'll be a lot happier. See below.

I tried to reply to this thread in firefox and got nowhere. So here
I am in ie7 hoping I don't get the dreaded 'needs to close
encountered problem' treatment

Anyway, the 'process explorer' app


My apologies - I was in autopilot mode...sorry! It was a lot eaiser to
remember the product names before Sysinternals was absorbed into the
collective. It's actually Process *Monitor* -

http://technet.microsoft.com/en-us/s.../bb896645.aspx



I don't see anything there that will allow the user to run the programs



doesn't look like it will solve
anything for me. And if I need to edit registries and write code for
the OS, I'm not going to be able to do it.


Ain't no code to write. However, you will indeed need to edit the registry
and you will indeed need to edit some NTFS permissions in the file system.



I'll spend some time looking at the registry edit tutorials and NTFS tutorials



Why can't limited accounts and guest accounts run software I install
at the admin level?


Because the people who wrote the software are lazy eedjits? What do the
developers say when you ask them? If their answer is "Make the users admins"
then tell them to go pound sand.



If I could find the link to inform the devs, then I would. It's not on
microsoft.com
When I go there it leads to some crazy connect.microsoft.com place to sign
up for some online seminars or something



If they can't install their own programs and can't run programs
installed in admin, then what good are limited and guests accounts?


There should be no"guest" enabled if you value your security, and Limited
User means just that - they *shouldn't* be installing software, etc.



You're right I shouldn't allow them to install software. I didn't know that
enabling the guest would compromise security. I'll change that.


Limited users should be able to *run* programs you installed as an admin.


Still looking for a way to do it.



I can run MS office apps and ie7 and firefox and those things, but
when I try to run a game or 3d party software, I get the 'can't
write to so and so' message.


See "eedjit" comment above.

I'm no computer programmer or IT guy, but i'd really like to use the
limited and guest accounts. Is there an 'easy' way to make it work
besides editing registries and writing code for xp media center?


Again, there's no code to write - and check out the correct Sysinternals
tool I mentioned above. Sorry for the confusion; I was multitasking.


The tool looks cool and all but I don't have the skills to understand what
to do after I see all the data.

Re your access to the groups:

Try using a news client, such as Forte Agent, Thunderbird, or even Outlook
Express, rather than the pretty clunky web interface to the newsgroups. It's
a lot easier to do nearly everything that way. You can mark messages to be
watched, filter the views so you can see replies to your posts easily, and
search.

The Microsoft public news server is msnews.microsoft.com and you can
subscribe to as many groups as you like; no authentication is required.

The following is from a post by MVP Malke ...

-------------------------------------------------------
Here's information on Usenet and using a newsreader:

http://www.elephantboycomputers.com/page3.html#12-09-02 - a brief
explanation of newsgroups
http://michaelstevenstech.com/outlo...ssnewreader.htm
http://rickrogers.org/setupoe.htm
http://support.microsoft.com/defaul...wto/default.asp
- Set Up Newsreader

http://www.dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html
http://aumha.org/nntp.htm - list of MS newsgroups
microsoft.public.test.here - MS group to test if your newsreader is
working properly
http://www.mailmsg.com/SPAM_munging.htm - how to munge email address
http://www.blakjak.demon.co.uk/mul_crss.htm - multiposting vs.
crossposting

Some newsreaders for Windows
http://www.forteinc.com/agent/index.php - for Forte
http://www.mozilla.org (Thunderbird does newsgroups)
http://gravity.tbates.org/

-------------------------------------


I know I'm a n00b in the newsgroups. I don't have the desire right now to
go any deaper.




  #12  
Old January 28th 08, 11:31 PM posted to microsoft.public.windowsxp.security_admin
ed black[_2_]
external usenet poster
 
Posts: 8
Default Group Policy Editor



"Lanwench [MVP - Exchange]" wrote:

ed black wrote:
"Lanwench [MVP - Exchange]" wrote:



Not sure what you searched for in Help & Support - even *outside* of
MCE, this would not be a group policy issue. If you google for
"limited user" application error etc you will find a lot.


Right, I never googled 'limited user' application error.


You ought to be complaining to the doofuses who wrote the third party
applications which your end users cannot run. :-)




Thanks for clarifying that sysinternal app. I'll look into that
later. I'll try to walk through the 'Help and Support' on the start
menu

Open Help and Support
Pick a Help topic -- System administration
Security and administration tools
Overviews, articles, and tutorials -- Using Group Policy


OK - bu why would you search for or pick that option? Again: this isn't a
policy issue at all. It's really no more useful in your situation than if
you searched for "how do I use Notepad.exe" :-)


It went something like I found the problem, went to microsoft, typed in some
questions and keywords, 'user can't run software' 'user account problem'
stuff like that. Everything led to group policy editor so I went to run as
and did gpedit.msc and didn't understand it, so I went to the H&S and looked
it up



"In an environment where you have one stand-alone computer or
several computers joined in a workgroup, you can still use Group
Policy to customize your computer.

To open Group Policy

Click Start, and then click Run.
Type gpedit.msc and then click OK.
When Group Policy opens, you will see two options in Local Computer
Policy: Computer Configuration and User Configuration. Computer
Configuration allows you to set policies that apply to your computer,
regardless of who logs on. User Configuration allows you to set
policies that apply to each user who logs on to the computer."


" To open the Software Installation snap-in
Open the Group Policy snap-in.
To assign software applications to computers, in the console tree
double-click Computer Configuration. To assign or publish software
applications to users, in the console tree double-click User
Configuration. Double-click Software Settings, and then click
Software installation. Where?

policy name Policy
Computer Configuration (or User Configuration)
Software Settings
Software installation"


And at the part where I get to 'Software Installation' it's not
there.
I open up the Software Settings Folder and it's empty. It's a dead
end. Nothing to do in the 'Software Settings Folder'

I gotta run. I'll look at the process thing after work.

Thanks again Lanwench


No problem. I think you're correct in that there's an error in the Help &
Support (without a domain, you technically don't have group policy - you
just have a local policy).

However, this is not a group policy thing - you don't even have group policy
because you aren't on a domain. You have a local policy, and you do NOT want
to mess with it - you'd end up locking yourself out too.


You say it's not a group policy thing and technet.microsoft says it is. I'm
willing to try your fix, but so far I'm at a loss at what my next step would
be after I dl the process monitor and run it.

This is a permissions issue, plain and simple - in the file system & perhaps
also in the registry. And it's due to the developers.


I can't be the only one with MCE who has this issue. I'd like to report it,
but like I've said before, there is no 'submit a bug to the developer' link
that I can find



  #13  
Old January 29th 08, 03:26 AM posted to microsoft.public.windowsxp.security_admin
Lanwench [MVP - Exchange]
external usenet poster
 
Posts: 1,547
Default Group Policy Editor

ed black wrote:
"Lanwench [MVP - Exchange]" wrote:

ed black wrote:
why am i not surprised that this newsgroup is not firefox friendly?


You wouldn't use Firefox to access a *newsgroup* - it's a web
browser. Thunderbird is a newsreader. Don't use the crummy web
interface to access these groups at all and you'll be a lot happier.
See below.

I tried to reply to this thread in firefox and got nowhere. So here
I am in ie7 hoping I don't get the dreaded 'needs to close
encountered problem' treatment

Anyway, the 'process explorer' app


My apologies - I was in autopilot mode...sorry! It was a lot eaiser
to remember the product names before Sysinternals was absorbed into
the collective. It's actually Process *Monitor* -

http://technet.microsoft.com/en-us/s.../bb896645.aspx



I don't see anything there that will allow the user to run the
programs


Download it and run it as I suggested, find where it fails, and manually
change the permissions.



doesn't look like it will solve
anything for me. And if I need to edit registries and write code
for the OS, I'm not going to be able to do it.


Ain't no code to write. However, you will indeed need to edit the
registry and you will indeed need to edit some NTFS permissions in
the file system.



I'll spend some time looking at the registry edit tutorials and NTFS
tutorials





Why can't limited accounts and guest accounts run software I
install at the admin level?


Because the people who wrote the software are lazy eedjits? What do
the developers say when you ask them? If their answer is "Make the
users admins" then tell them to go pound sand.



If I could find the link to inform the devs, then I would. It's not
on microsoft.com


Right, because this is *not* *Microsoft*. It's your third party software
developers....as I've now stated three times


When I go there it leads to some crazy connect.microsoft.com place to
sign
up for some online seminars or something



If they can't install their own programs and can't run programs
installed in admin, then what good are limited and guests accounts?


There should be no"guest" enabled if you value your security, and
Limited User means just that - they *shouldn't* be installing
software, etc.



You're right I shouldn't allow them to install software. I didn't
know that enabling the guest would compromise security. I'll change
that.


Good.


Limited users should be able to *run* programs you installed as an
admin.


Still looking for a way to do it.


See above - I've already explained what you'll need to do.



I can run MS office apps and ie7 and firefox and those things, but
when I try to run a game or 3d party software, I get the 'can't
write to so and so' message.


See "eedjit" comment above.

I'm no computer programmer or IT guy, but i'd really like to use the
limited and guest accounts. Is there an 'easy' way to make it work
besides editing registries and writing code for xp media center?


Again, there's no code to write - and check out the correct
Sysinternals tool I mentioned above. Sorry for the confusion; I was
multitasking.


The tool looks cool and all but I don't have the skills to understand
what
to do after I see all the data.


Sorry, I don't know how to help further.


Re your access to the groups:

Try using a news client, such as Forte Agent, Thunderbird, or even
Outlook Express, rather than the pretty clunky web interface to the
newsgroups. It's a lot easier to do nearly everything that way. You
can mark messages to be watched, filter the views so you can see
replies to your posts easily, and search.

The Microsoft public news server is msnews.microsoft.com and you can
subscribe to as many groups as you like; no authentication is
required.

The following is from a post by MVP Malke ...

-------------------------------------------------------
Here's information on Usenet and using a newsreader:

http://www.elephantboycomputers.com/page3.html#12-09-02 - a brief
explanation of newsgroups
http://michaelstevenstech.com/outlo...ssnewreader.htm
http://rickrogers.org/setupoe.htm
http://support.microsoft.com/defaul...wto/default.asp
- Set Up Newsreader

http://www.dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html
http://aumha.org/nntp.htm - list of MS newsgroups
microsoft.public.test.here - MS group to test if your newsreader is
working properly
http://www.mailmsg.com/SPAM_munging.htm - how to munge email address
http://www.blakjak.demon.co.uk/mul_crss.htm - multiposting vs.
crossposting

Some newsreaders for Windows
http://www.forteinc.com/agent/index.php - for Forte
http://www.mozilla.org (Thunderbird does newsgroups)
http://gravity.tbates.org/

-------------------------------------


I know I'm a n00b in the newsgroups. I don't have the desire right
now to
go any deaper.


Your call.



  #14  
Old January 29th 08, 03:29 AM posted to microsoft.public.windowsxp.security_admin
Lanwench [MVP - Exchange]
external usenet poster
 
Posts: 1,547
Default Group Policy Editor

ed black wrote:
"Lanwench [MVP - Exchange]" wrote:

ed black wrote:
"Lanwench [MVP - Exchange]" wrote:



Not sure what you searched for in Help & Support - even *outside*
of MCE, this would not be a group policy issue. If you google for
"limited user" application error etc you will find a lot.


Right, I never googled 'limited user' application error.


You ought to be complaining to the doofuses who wrote the third
party applications which your end users cannot run. :-)




Thanks for clarifying that sysinternal app. I'll look into that
later. I'll try to walk through the 'Help and Support' on the start
menu

Open Help and Support
Pick a Help topic -- System administration
Security and administration tools
Overviews, articles, and tutorials -- Using Group Policy


OK - bu why would you search for or pick that option? Again: this
isn't a policy issue at all. It's really no more useful in your
situation than if you searched for "how do I use Notepad.exe" :-)


It went something like I found the problem, went to microsoft, typed
in some questions and keywords, 'user can't run software' 'user
account problem' stuff like that. Everything led to group policy
editor so I went to run as and did gpedit.msc and didn't understand
it, so I went to the H&S and looked it up


OK. But most of IT is knowing how to search - learning by trial and error.



"In an environment where you have one stand-alone computer or
several computers joined in a workgroup, you can still use Group
Policy to customize your computer.

To open Group Policy

Click Start, and then click Run.
Type gpedit.msc and then click OK.
When Group Policy opens, you will see two options in Local Computer
Policy: Computer Configuration and User Configuration. Computer
Configuration allows you to set policies that apply to your
computer, regardless of who logs on. User Configuration allows you
to set policies that apply to each user who logs on to the
computer."


" To open the Software Installation snap-in
Open the Group Policy snap-in.
To assign software applications to computers, in the console tree
double-click Computer Configuration. To assign or publish software
applications to users, in the console tree double-click User
Configuration. Double-click Software Settings, and then click
Software installation. Where?

policy name Policy
Computer Configuration (or User Configuration)
Software Settings
Software installation"


And at the part where I get to 'Software Installation' it's not
there.
I open up the Software Settings Folder and it's empty. It's a dead
end. Nothing to do in the 'Software Settings Folder'

I gotta run. I'll look at the process thing after work.

Thanks again Lanwench


You're welcome. But please don't muck around in your local computer policy.
You'll likely lock yourself out.


No problem. I think you're correct in that there's an error in the
Help & Support (without a domain, you technically don't have group
policy - you just have a local policy).

However, this is not a group policy thing - you don't even have
group policy because you aren't on a domain. You have a local
policy, and you do NOT want to mess with it - you'd end up locking
yourself out too.


You say it's not a group policy thing and technet.microsoft says it
is. I'm willing to try your fix, but so far I'm at a loss at what my
next step would be after I dl the process monitor and run it.

This is a permissions issue, plain and simple - in the file system &
perhaps also in the registry. And it's due to the developers.


I can't be the only one with MCE who has this issue. I'd like to
report it, but like I've said before, there is no 'submit a bug to
the developer' link that I can find


This is not an MCE issue.
This is not a Microsoft issue.

This is an issue with the PEOPLE WHO WROTE THE !@#$ SOFTWARE THAT WON'T RUN

(sorry for yelling, I've already tried to be clear about this several times)





  #15  
Old January 29th 08, 12:40 PM posted to microsoft.public.windowsxp.security_admin
ed black[_2_]
external usenet poster
 
Posts: 8
Default Group Policy Editor



"Lanwench [MVP - Exchange]" wrote:

ed black wrote:
"Lanwench [MVP - Exchange]" wrote:

ed black wrote:
"Lanwench [MVP - Exchange]" wrote:



Not sure what you searched for in Help & Support - even *outside*
of MCE, this would not be a group policy issue. If you google for
"limited user" application error etc you will find a lot.


Right, I never googled 'limited user' application error.


You ought to be complaining to the doofuses who wrote the third
party applications which your end users cannot run. :-)




Thanks for clarifying that sysinternal app. I'll look into that
later. I'll try to walk through the 'Help and Support' on the start
menu

Open Help and Support
Pick a Help topic -- System administration
Security and administration tools
Overviews, articles, and tutorials -- Using Group Policy

OK - bu why would you search for or pick that option? Again: this
isn't a policy issue at all. It's really no more useful in your
situation than if you searched for "how do I use Notepad.exe" :-)


It went something like I found the problem, went to microsoft, typed
in some questions and keywords, 'user can't run software' 'user
account problem' stuff like that. Everything led to group policy
editor so I went to run as and did gpedit.msc and didn't understand
it, so I went to the H&S and looked it up


OK. But most of IT is knowing how to search - learning by trial and error.



"In an environment where you have one stand-alone computer or
several computers joined in a workgroup, you can still use Group
Policy to customize your computer.

To open Group Policy

Click Start, and then click Run.
Type gpedit.msc and then click OK.
When Group Policy opens, you will see two options in Local Computer
Policy: Computer Configuration and User Configuration. Computer
Configuration allows you to set policies that apply to your
computer, regardless of who logs on. User Configuration allows you
to set policies that apply to each user who logs on to the
computer."


" To open the Software Installation snap-in
Open the Group Policy snap-in.
To assign software applications to computers, in the console tree
double-click Computer Configuration. To assign or publish software
applications to users, in the console tree double-click User
Configuration. Double-click Software Settings, and then click
Software installation. Where?

policy name Policy
Computer Configuration (or User Configuration)
Software Settings
Software installation"


And at the part where I get to 'Software Installation' it's not
there.
I open up the Software Settings Folder and it's empty. It's a dead
end. Nothing to do in the 'Software Settings Folder'

I gotta run. I'll look at the process thing after work.

Thanks again Lanwench


You're welcome. But please don't muck around in your local computer policy.
You'll likely lock yourself out.


No problem. I think you're correct in that there's an error in the
Help & Support (without a domain, you technically don't have group
policy - you just have a local policy).

However, this is not a group policy thing - you don't even have
group policy because you aren't on a domain. You have a local
policy, and you do NOT want to mess with it - you'd end up locking
yourself out too.


You say it's not a group policy thing and technet.microsoft says it
is. I'm willing to try your fix, but so far I'm at a loss at what my
next step would be after I dl the process monitor and run it.

This is a permissions issue, plain and simple - in the file system &
perhaps also in the registry. And it's due to the developers.


I can't be the only one with MCE who has this issue. I'd like to
report it, but like I've said before, there is no 'submit a bug to
the developer' link that I can find


This is not an MCE issue.
This is not a Microsoft issue.

This is an issue with the PEOPLE WHO WROTE THE !@#$ SOFTWARE THAT WON'T RUN

(sorry for yelling, I've already tried to be clear about this several times)




I find it interesting that you insist it's not a microsoft issue. I'll
repeat what I went through earlier


" To open the Software Installation snap-in
Open the Group Policy snap-in.
To assign software applications to computers, in the console tree
double-click Computer Configuration. To assign or publish software
applications to users, in the console tree double-click User
Configuration. Double-click Software Settings, and then click
Software installation. Where?

policy name Policy
Computer Configuration (or User Configuration)
Software Settings
Software installation"


And at the part where I get to 'Software Installation' it's not
there.
I open up the Software Settings Folder and it's empty. It's a dead
end. Nothing to do in the 'Software Settings Folder'




The microsoft H&S files written in the OS and supplied with thexp MCE OS say
this can be done.

I GET THERE AND THE FOLDERS EMPTY --- no "Software Installation" node in
the "Software Settings" Folder.

You and I can yell and shout all we want. It doesn't change this fact.
Forget about my 3d party software that doesn't run. That's no longer the
issue, explain the issue with the empty "Software Settings" Folder.

Or do you even care that there's a flaw in the MS component? Is it so
trivial, that I as an End User shouldn't be concerned about it.

You're probably right, I probably shouldn't mess with the Local Policy or
the Group policy, But like I said, there's a problem with the GPE. I
understand that xp mce is obsolete and Vista is the latest flavor, but at
least recognize there's a problem with the GPE. You can't deny it, I can
supply screenshots or whatever.

Good Day, And you don't need to reply again if you're going to skirt the
issue of the flawed GPE.
 




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is Off
HTML code is Off






All times are GMT +1. The time now is 02:27 PM.


Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright ©2004-2024 PCbanter.
The comments are property of their posters.