[642] in winnt
Re: apply compatws.inf--Answer
daemon@ATHENA.MIT.EDU (Barbara Santorella)
Wed Feb 28 12:15:23 2001
Message-ID: <3A9D3166.AF6DC820@mit.edu>
Date: Wed, 28 Feb 2001 12:12:06 -0500
From: Barbara Santorella <bsantore@MIT.EDU>
MIME-Version: 1.0
To: ntpartners@mit.edu
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Here's the answer, taken from TechNet:
*****Paste from Technet ******
What if I don't want end users to be Power Users when running legacy
applications?
. . . The template is named compatws.inf and can be found in the
%windir%\security\templates directory. The template can be applied to a
system using the Security Configuration Toolset. For example, the
secedit.exe command line component of the Toolset can apply the template
as follows:
secedit /configure /cfg compatws.inf /db compatws.sdb
This template loosens up security for Users in a matter consistent with
the requirements of most legacy applications.
*****End of Paste *****
I applied this and it appeared to work, except that Netscape loads
(which is an improvement, without the compatws it doesn't load at all)
but an error message pops up saying "Failed to update the system
registry, please try using REGEDIT." I guess the answer is to find out
what/why Netscape needs to update the registry and see if I can allow
that in the security settings without making all users Power Users.
Barbara Santorella wrote:
>
> Does anyone know if the compatws.inf template can be applied to a
> Windows 2000 PC using the local security policy? (i.e. without Active
> Directory) I want regular users to be able to run Office 97 on the
> machine. In the past I have made users who log into the machine power
> users, but since users log into the domain and not the machne, that
> means that I have to create a global group and add the global group to
> the local group. That's not something I want to do for a lot of
> machines.
