[643] in winnt
Re: apply compatws.inf--Answer
daemon@ATHENA.MIT.EDU (David S. Woodruff)
Wed Feb 28 13:45:00 2001
Date: Wed, 28 Feb 2001 13:40:21 -0500 (EST)
From: "David S. Woodruff" <dsw@lns.mit.edu>
To: Barbara Santorella <bsantore@MIT.EDU>
cc: <ntpartners@MIT.EDU>
In-Reply-To: <3A9D3166.AF6DC820@mit.edu>
Message-ID: <Pine.OSF.4.30.0102281335560.13356-100000@pequod.mit.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Hi Barbara,
The following registry changes will make Netscape useable by ordinary
users. They won't need to be made Power Users.
This came to me from Kyle Pope, but I understand someone else (Bryant?)
was the originator.
This is JUST A WORKAROUND. You can expect a better solution from IS soon.
Dave
-----------------------------------------
These are the changes we made to allow Netscape to
run on the OSP Windows 2000
machines. In all cases, we used Authenticated Users as the
vehicle of change.
1. c:\winnt\nsreg.dat - give Authenticated Users 'modify'
permission
2. c:\Program Files\Netscape - give AUsers 'modify'
permission to this folder and all
subfolders
3. Grant "query, set, create, enumerate, notify, and read"
permissions to the following
registry keys:
HKLM\System\CurrentControlSet\Control\Media\MediaProperties\PrivPropert
es\Joystick
HKCR\aimfile (may not be there if Instant Messenger
is not installed)
HKCR\ftp
HKCR\gopher
HKCR\http
HKCR\https
HKCR\news
HKCR\snews
HKCR\CLSID
HKCR\NetscapeMarkup
HKCR\Netscape.Help.1
HKCR\Netscape.Network.1
HKCR\Netscape.Registry.1
HKCR\Netscape.TalkNav.1
In all cases of registry keys, follow this procedure:
Highlight key to be changed, select SecurityPermissions
Choose Advanced, go to Add
Select Authenticated Users, give permissions discussed above
After hitting OK, select "Reset permissions on all child
objects..." and then Apply.
Kyle
--------------------
On Wed, 28 Feb 2001, Barbara Santorella wrote:
> Here's the answer, taken from TechNet:
>
> *****Paste from Technet ******
> What if I don't want end users to be Power Users when running legacy
> applications?
>
> . . . The template is named compatws.inf and can be found in the
> %windir%\security\templates directory. The template can be applied to a
> system using the Security Configuration Toolset. For example, the
> secedit.exe command line component of the Toolset can apply the template
> as follows:
> secedit /configure /cfg compatws.inf /db compatws.sdb
> This template loosens up security for Users in a matter consistent with
> the requirements of most legacy applications.
> *****End of Paste *****
>
> I applied this and it appeared to work, except that Netscape loads
> (which is an improvement, without the compatws it doesn't load at all)
> but an error message pops up saying "Failed to update the system
> registry, please try using REGEDIT." I guess the answer is to find out
> what/why Netscape needs to update the registry and see if I can allow
> that in the security settings without making all users Power Users.
>
>
> Barbara Santorella wrote:
> >
> > Does anyone know if the compatws.inf template can be applied to a
> > Windows 2000 PC using the local security policy? (i.e. without Active
> > Directory) I want regular users to be able to run Office 97 on the
> > machine. In the past I have made users who log into the machine power
> > users, but since users log into the domain and not the machne, that
> > means that I have to create a global group and add the global group to
> > the local group. That's not something I want to do for a lot of
> > machines.
>
David S. Woodruff http://www.lns.mit.edu/~dsw
MIT Lab for Nuclear Science Phone: (617)-253-6943
24-030g, MIT Email: dsw@mitlns.mit.edu
77 Massachusetts Avenue FAX: (617)-258-6591
Cambridge, MA, 02139 Call me Ishmael.
