HI all

I'm (unfortunately) running Term-Serv on our Domain Controller.. not by choice. the term-serve is created specifically for users to connect to quickbooks2003 which requires "Power User" rights or higher. this is fine for all of our XP machines on the netowrk as they offer both local and domain logins.. but my PDC becuase its a PDC doesnt have a local login anymore, and therefore, no "Power Users Group". It appears that there is no way around this except to give all users Admin rights.. which for obvious reasons is just stupid.

anybody have a work around, or know the steps to emulate a "power users group" on a Domain Controller

Thanks in advance for your help
-Chri

Hi Chris.

Try contacting the publisher to see if they can tell you what registry/folder
permissions need to be changed to allow a regular user to run their application.
Sounds kind of nuts that a 2003 application still requires users to have excessive
permissions. If they refuse to help or act stupid, then you may try using the free
tools filemon and regmon from SysInternals to roll your own permissions changes. You
need to logon as a regular user and then use runas to invoke filemon and then read
the log where access is denied. Make the necessary change and try again. You may need
to do the same with regmon.

If that does not work you can apply the compatws.inf template to that server which
will change permissions so that regular users will have the same permissions as a
power user but not the additional rights such as the ability to create shares and non
admin users, but still not recommended on a domain controller. I don't see how you
can possibly give them admin permissions to a domain controller because then everyone
will be a domain administrator and you do NOT want that and may have to resort to
installing another server to use as TS and not make it a domain controller - believe
me the cost would be justified. --- Steve

http://www.sysinternals.com/ntw2k/source/filemon.shtml
http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/sag_SCEdefaultpols.htm

"chrisporter" wrote in message
news:5219005D-24D2-47D4-9885-C01C35B881AB@microsoft.com...
> HI all,
>
> I'm (unfortunately) running Term-Serv on our Domain Controller.. not by choice. the
term-serve is created specifically for users to connect to quickbooks2003 which
requires "Power User" rights or higher. this is fine for all of our XP machines on
the netowrk as they offer both local and domain logins.. but my PDC becuase its a PDC
doesnt have a local login anymore, and therefore, no "Power Users Group". It appears
that there is no way around this except to give all users Admin rights.. which for
obvious reasons is just stupid..
>
> anybody have a work around, or know the steps to emulate a "power users group" on a
Domain Controller?
>
> Thanks in advance for your help!
> -Chris
>

Thanks! i'm going to give this a shot. i found a document on msft that outlined what the differences were between a power user and a regular user.. after applying all of those settings to files & reg keys.. still nothing. so here's hoping :

i've tried talking to intuit about this, but their support database is 'extensive' and has what i would guess to be 3 articles in it about anything.. and their training is just about as good. if i ask about registry keys, their response will probably be something like "so & so has already been married, and their gift registry is closed"

(yeah i'm a bit bummed by them... at the moment

o and get this.... their 2004 version is out.... still no security stuff taken in to account...

Thanks for your help
-Chri

----- Steven L Umbach wrote: ----

Hi Chris

Try contacting the publisher to see if they can tell you what registry/folde
permissions need to be changed to allow a regular user to run their application
Sounds kind of nuts that a 2003 application still requires users to have excessiv
permissions. If they refuse to help or act stupid, then you may try using the fre
tools filemon and regmon from SysInternals to roll your own permissions changes. Yo
need to logon as a regular user and then use runas to invoke filemon and then rea
the log where access is denied. Make the necessary change and try again. You may nee
to do the same with regmon

If that does not work you can apply the compatws.inf template to that server whic
will change permissions so that regular users will have the same permissions as
power user but not the additional rights such as the ability to create shares and no
admin users, but still not recommended on a domain controller. I don't see how yo
can possibly give them admin permissions to a domain controller because then everyon
will be a domain administrator and you do NOT want that and may have to resort t
installing another server to use as TS and not make it a domain controller - believ
me the cost would be justified. --- Stev

http://www.sysinternals.com/ntw2k/source/filemon.shtm
http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/sag_SCEdefaultpols.ht

"chrisporter" wrote in messag
news:5219005D-24D2-47D4-9885-C01C35B881AB@microsoft.com..
> HI all
>> I'm (unfortunately) running Term-Serv on our Domain Controller.. not by choice. th
term-serve is created specifically for users to connect to quickbooks2003 whic
requires "Power User" rights or higher. this is fine for all of our XP machines o
the netowrk as they offer both local and domain logins.. but my PDC becuase its a PD
doesnt have a local login anymore, and therefore, no "Power Users Group". It appear
that there is no way around this except to give all users Admin rights.. which fo
obvious reasons is just stupid.
>> anybody have a work around, or know the steps to emulate a "power users group" on
Domain Controller
>> Thanks in advance for your help
> -Chri
>

and in a final follow up.....
regmon officially rocks! i found the keys in about 4 tries... enabled access to them and blammo it ran fine. now to create a script for this to apply next time this happens & i'm set. Thanks for all the pointers!!
-Chri


----- Chris Porter wrote: ----

Thanks! i'm going to give this a shot. i found a document on msft that outlined what the differences were between a power user and a regular user.. after applying all of those settings to files & reg keys.. still nothing. so here's hoping :

i've tried talking to intuit about this, but their support database is 'extensive' and has what i would guess to be 3 articles in it about anything.. and their training is just about as good. if i ask about registry keys, their response will probably be something like "so & so has already been married, and their gift registry is closed"

(yeah i'm a bit bummed by them... at the moment

o and get this.... their 2004 version is out.... still no security stuff taken in to account...

Thanks for your help
-Chri

----- Steven L Umbach wrote: ----

Hi Chris

Try contacting the publisher to see if they can tell you what registry/folde
permissions need to be changed to allow a regular user to run their application
Sounds kind of nuts that a 2003 application still requires users to have excessiv
permissions. If they refuse to help or act stupid, then you may try using the fre
tools filemon and regmon from SysInternals to roll your own permissions changes. Yo
need to logon as a regular user and then use runas to invoke filemon and then rea
the log where access is denied. Make the necessary change and try again. You may nee
to do the same with regmon

If that does not work you can apply the compatws.inf template to that server whic
will change permissions so that regular users will have the same permissions as
power user but not the additional rights such as the ability to create shares and no
admin users, but still not recommended on a domain controller. I don't see how yo
can possibly give them admin permissions to a domain controller because then everyon
will be a domain administrator and you do NOT want that and may have to resort t
installing another server to use as TS and not make it a domain controller - believ
me the cost would be justified. --- Stev

http://www.sysinternals.com/ntw2k/source/filemon.shtm
http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/sag_SCEdefaultpols.ht

"chrisporter" wrote in messag
news:5219005D-24D2-47D4-9885-C01C35B881AB@microsoft.com..
> HI all
>> I'm (unfortunately) running Term-Serv on our Domain Controller.. not by choice. th
term-serve is created specifically for users to connect to quickbooks2003 whic
requires "Power User" rights or higher. this is fine for all of our XP machines o
the netowrk as they offer both local and domain logins.. but my PDC becuase its a PD
doesnt have a local login anymore, and therefore, no "Power Users Group". It appear
that there is no way around this except to give all users Admin rights.. which fo
obvious reasons is just stupid.
>> anybody have a work around, or know the steps to emulate a "power users group" on
Domain Controller
>> Thanks in advance for your help
> -Chri
>

Glad it worked and thanks for posting back your results. --- Steve

"Chris Porter" wrote in message
news:87FCF360-B8E1-4455-858D-22C602D2D6F6@microsoft.com...
> and in a final follow up......
> regmon officially rocks! i found the keys in about 4 tries... enabled access to
them and blammo it ran fine. now to create a script for this to apply next time this
happens & i'm set. Thanks for all the pointers!!!
> -Chris
>
>
> ----- Chris Porter wrote: -----
>
> Thanks! i'm going to give this a shot. i found a document on msft that
outlined what the differences were between a power user and a regular user.. after
applying all of those settings to files & reg keys.. still nothing. so here's hoping
:)
>
> i've tried talking to intuit about this, but their support database is
'extensive' and has what i would guess to be 3 articles in it about anything.. and
their training is just about as good. if i ask about registry keys, their response
will probably be something like "so & so has already been married, and their gift
registry is closed"
>
> (yeah i'm a bit bummed by them... at the moment)
>
> o and get this.... their 2004 version is out.... still no security stuff taken
in to account....
>
> Thanks for your help!
> -Chris
>
> ----- Steven L Umbach wrote: -----
>
> Hi Chris.
>
> Try contacting the publisher to see if they can tell you what
registry/folder
> permissions need to be changed to allow a regular user to run their
application.
> Sounds kind of nuts that a 2003 application still requires users to have
excessive
> permissions. If they refuse to help or act stupid, then you may try using
the free
> tools filemon and regmon from SysInternals to roll your own permissions
changes. You
> need to logon as a regular user and then use runas to invoke filemon and
then read
> the log where access is denied. Make the necessary change and try again.
You may need
> to do the same with regmon.
>
> If that does not work you can apply the compatws.inf template to that
server which
> will change permissions so that regular users will have the same
permissions as a
> power user but not the additional rights such as the ability to create
shares and non
> admin users, but still not recommended on a domain controller. I don't
see how you
> can possibly give them admin permissions to a domain controller because
then everyone
> will be a domain administrator and you do NOT want that and may have to
resort to
> installing another server to use as TS and not make it a domain
controller - believe
> me the cost would be justified. --- Steve
>
> http://www.sysinternals.com/ntw2k/source/filemon.shtml
>
http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/sag_SCEdefaultpols.htm
>
> "chrisporter" wrote in message
> news:5219005D-24D2-47D4-9885-C01C35B881AB@microsoft.com...
> > HI all,
> >> I'm (unfortunately) running Term-Serv on our Domain Controller.. not
by choice. the
> term-serve is created specifically for users to connect to quickbooks2003
which
> requires "Power User" rights or higher. this is fine for all of our XP
machines on
> the netowrk as they offer both local and domain logins.. but my PDC
becuase its a PDC
> doesnt have a local login anymore, and therefore, no "Power Users Group".
It appears
> that there is no way around this except to give all users Admin rights..
which for
> obvious reasons is just stupid..
> >> anybody have a work around, or know the steps to emulate a "power
users group" on a
> Domain Controller?
> >> Thanks in advance for your help!
> > -Chris
> >