|
Posted by Roger Abell [MVP] on August 24, 2006, 11:58 pm
Please log in for more thread options
> For the OP power users can also share folders so you may want to look at
> removing them from the power users or administrators group and making sure
> that they are only regular users. Locally on one of the computer run the
> command net user username using the actual username to see the groups that
> the user belongs to on the computer. Also make sure the user is not a
> member of a domain group that is a member of the local administrators or
> power users group on his computer. A regular user can not create shares on
> their computer.
Right now we still have small luxury to believe granting
Power Users membership to an account differs from giving
membership in Administrators, as elevation bits are not quite
on every keychain/device yet.
But realistically today on a non-DC one has only the one main
distinction, limited or admin account with which to work.
(Guest is a net access phenonmena else it is a full limited if
usable for local login, and PU --> adm trivial).
If people out there are using PU as if they are "for sure" keeping
adm contained there is some need for rethinking this use.
>
>> I'm not giving users the admin accounts. They are the users of a group
>> abc,
>> and I want to disable sharing tab for this group members. Please help me
>> on
>> this issue.
>>
>> "Roger Abell [MVP]" wrote:
>>
>>> It is, arguably, more simple to just not give then admin accounts.
>>> If they are admins then there is nothing you can do to prevent them
>>> from sharing out something if they really want to do so.
>>>
>>> > My network has 2003 domain controller, pl help me configure group
>>> > policy
>>> > so
>>> > that my users cannot share there local drives. In short disabling
>>> > sharing
>>> > tab
>>> > in client systems.
>>>
>>>
>>>
>
>
| 
XML Sitemap