Click here to get back home

What has Windows 2003 Server security done to domain user profiles

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
What has Windows 2003 Server security done to domain user profiles Geald Fay 01-17-2006
Get Chitika Premium
Posted by Geald Fay on January 17, 2006, 11:49 pm
Please log in for more thread options
I have been running Visual Dbase (DB2k) for years on our network with no
problems. Now I find adding a new users with a domain user profile and then
trying to run the program it is unable to read or load it's ini file. The
program runs from the users XP SP2 machine. In fact the situation is so bad
as the user I cannot even edit the vdb.ini file anymore!! If I give the user
domain administrator rights there is not problem.

Is there a way to allow a domain user to run a program which uses ini files
to load defaults, or has security gone so far that we are back in the stone
age ??



Posted by Roger Abell [MVP] on January 18, 2006, 12:32 am
Please log in for more thread options
You issue may be as simple as Users group having only Read/Execute
(not Modify) granted on the application's files. If so this is due to the
application not following the specifications for a well-behaved (logo
certifiable) application which require that modifiable data be stored in
the correct areas and not with the program's binaries.

--
Roger Abell
Microsoft MVP (Windows Server : Security)
MCDBA, MCSE W2k3+W2k+Nt4
>I have been running Visual Dbase (DB2k) for years on our network with no
> problems. Now I find adding a new users with a domain user profile and
> then
> trying to run the program it is unable to read or load it's ini file. The
> program runs from the users XP SP2 machine. In fact the situation is so
> bad
> as the user I cannot even edit the vdb.ini file anymore!! If I give the
> user
> domain administrator rights there is not problem.
>
> Is there a way to allow a domain user to run a program which uses ini
> files
> to load defaults, or has security gone so far that we are back in the
> stone
> age ??
>
>



Posted by Gerald Fay on January 18, 2006, 1:37 am
Please log in for more thread options
I suspect you are correct. Am I right in suspecting this
is not then a server security issue, but a local
security issue on the XP machine?

Dbase does keep the vdb.ini in the BIN directory.

Also until the recent security updates to Server and XP
all domain users who were using the program had, and
continue to have, no trouble. This is only a problem for
new domain users added recently.

Are you saying that by creating a share to the local
application directory (containing the ini and the exe)
and adding modify rights it should work? I've tried this
by giving everyone permission, and it did not work.


mvpNoSpam@asu.edu says...
> You issue may be as simple as Users group having only Read/Execute
> (not Modify) granted on the application's files. If so this is due to the
> application not following the specifications for a well-behaved (logo
> certifiable) application which require that modifiable data be stored in
> the correct areas and not with the program's binaries.
>
>

Posted by Roger Abell [MVP] on January 18, 2006, 6:28 pm
Please log in for more thread options
The tightening of permissions on application install areas began
with the release of W2k and tightened further with release of XP
and again with W2k3.
I am not familiar with your application architecture, as to where
and how users access the application. But, I would check how
the NTFS permissions are set (on the containing folder and on
the file itself also in case it is not inheriting), and if the access
is by a share over the network then also check the share level
permissions. The first is in the security tab in the properties of
the filesystem object, the second (share level) is under the
Permissions button on the Sharing tab for the shared folder
(again, in the properties of the underlying filesystem object).

Pay close attention to what groups have grants, and then
determine whether the new account that have issue are in
the groups as is so for the older account that have no problem.


--
Roger

>I suspect you are correct. Am I right in suspecting this
> is not then a server security issue, but a local
> security issue on the XP machine?
>
> Dbase does keep the vdb.ini in the BIN directory.
>
> Also until the recent security updates to Server and XP
> all domain users who were using the program had, and
> continue to have, no trouble. This is only a problem for
> new domain users added recently.
>
> Are you saying that by creating a share to the local
> application directory (containing the ini and the exe)
> and adding modify rights it should work? I've tried this
> by giving everyone permission, and it did not work.
>
>
> mvpNoSpam@asu.edu says...
>> You issue may be as simple as Users group having only Read/Execute
>> (not Modify) granted on the application's files. If so this is due to
>> the
>> application not following the specifications for a well-behaved (logo
>> certifiable) application which require that modifiable data be stored in
>> the correct areas and not with the program's binaries.
>>
>>



Similar ThreadsPosted
plz help to creating a windows server 2003 domain member user April 7, 2007, 3:08 am
Delete cached local copy of mandatory profile and non roaming domain user profiles ? May 1, 2008, 5:50 am
Windows 2003 Domain Security July 14, 2005, 11:06 am
Role-based security from Windows Server 2003 Security Guide gives problems November 6, 2006, 8:00 am
Windows server 2003 security. How to protect against 100's of invalid logons to the server?? August 12, 2005, 5:29 pm
Create restricted user account, 2003 server AD domain November 10, 2005, 10:39 pm
Windows 2003, Domain Controllers & "Manage auditing and security November 1, 2006, 4:43 pm
Windows 2003 server and VPN: Security(?) December 16, 2005, 4:20 pm
Windows domain user is sometimes denied access to server share October 2, 2006, 5:07 am
Security on a stand-alone windows 2003 Server August 8, 2005, 11:42 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap