Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Operating Systems Software Windows

Permanently Changing Windows XP Security Settings? 78

Posted by Cliff from the making-them-stick dept.
pnutjam asks: "I have googled and perused several publications seeking an answer but I find no mention of this problem anywhere. I am running applications not designed for a multi-user environment on Windows XP. To allow standard users to run these applications I've modified permissions on files, folders, and registry keys. Whenever a computer with the modifications is rebooted, the permissions revert to their previous settings. It doesn't happen when the users log off, only when the computers are rebooted." When adjusting Windows XP to support such applications, how do you make permission changes so that they survive through a reboot?
This discussion has been archived. No new comments can be posted.

Permanently Changing Windows XP Security Settings? More

Permanently Changing Windows XP Security Settings?

Comments Filter:

  • You ask this question here? (Score:5, Insightful)

    by andawyr ( 212118 ) on Monday May 17, 2004 @07:28PM (#9178514)
    Methinks this question would be better asked on a Windows-XX specific site. Here, you're likely to get bombarded with flames.....

    • Re:You ask this question here? (Score:4, Funny)

      by Marillion ( 33728 ) <ericbardes&gmail,com> on Monday May 17, 2004 @08:21PM (#9178941)
      Let me translate into Slashdot-eese.

      This person is really asking is, "How do I circumvent the unreasonable policies of the unwashed Microsoft conscripts that have taken over all of the Intel hardware?" He further pleads, "I want to be liberated. But I must be careful. If I outright revolt, if I install OpenBSD, they will send to a re-education camp." Which is located at the Unemployment Centre. "I could sneek in Cygwin [cygwin.com], remain below the radar, boost my productivity, get promoted, and finally TAKE OVER THE WHOLE OF IT!BWAAAHA HA HA HA!

      Sorry, got lost in the moment.


    • Why not here? The fact that running XP realisticly in a real-time environment is a major PITA may not be new news, but it's still news worthy. I'm in education and I have lost track of the number of software apps that XP killed on me. Who cares if they have a compatibility tool kit? Who has time for that?

      The point is, the policies are ok if they are an option, note that not too many ppl used them in Win95/98. Now everyone is forced to use them. Mr gates decided how everyone should run their busines
      • I'm not saying that the question was invalid; it was just asked in the entirely wrong place. /. is not a tech support forum. Had someone asked a Linux-specific tech support question, I would have said pretty much the same thing to them.

        It wasn't news, despite what you think. A knowledge base article, yes, but not news.
        • "It wasn't news, despite what you think. A knowledge base article, yes, but not news."


          This ain't "News from Slashdot", it's "Ask Slashdot". If you have no interest in the question being asked, go look at something else.

  • All you need is ........ (Score:3, Informative)

    by MrIrwin ( 761231 ) on Monday May 17, 2004 @07:33PM (#9178544) Journal
    An XP server domain, and everything will work fine!

    BTW, I have a subtle feeling that the TCO savings you get with XP server are because it is designed to be a pig to manage without it.

    What do mean you allready knew that......before the product was even beta'd????????

  • Depending on how your users are set up, the default in XP Professional (or at least the Enterprise-level license that my employer uses, YMMV depending on how much your IT department trusts lusers) is for users NOT to have local Admin Rights. Upon rebooting, file permissions would be reset from the Active Directory database- and I'd expect exactly this kind of behavior.

    Failing that, I'd have to examine your source, perhaps you aren't actually persisting the ADSI object properly to save to the Active Direc

    • Upon rebooting, file permissions would be reset from the Active Directory database- and I'd expect exactly this kind of behavior.

      Uhh, just exactly when did Microsoft move file system rights out of NTFS and into Active Directory?

      If that's true, then boy, do I feel like Rip Van Winkle...

      • Group Policy allows you to override permissions onto NTFS objects, registry keys, and even Active Directory objects. GPOs are stored in Active Directory.

        • Group Policy allows you to override permissions onto NTFS objects, registry keys, and even Active Directory objects. GPOs are stored in Active Directory.

          Yikes! When did that come out? Is it stable?

          I know that Novell has always resisted the temptation to move file permissions out of the NetWare file system and into Novell Directory Services simply because the file system permission structure is so massive and would bog down the directory tremendously. [You usually get just a single file system volume ob


          • I think he is speaking of local group policy, which does not require Active Directory, but can use it for policy enforcement.

            I believe AD just maintains a database of policies available on local machines.
            • No, he's talking about Active Directory Group Policy which provides all the functionality of local group policy but centralised. The file permissions area is just one part of it though, there are plenty of other bits (service startup state etc etc). Local Group Policy is a subset of the AD based group policy, not the other way round
          • The GPO does not store the file permissions of every file in the filesystem. It stores a policy that you wish to have applied to the filesystem on bootup, on login, or whenever policies are manually enforced.

            For instance, a common policy is to have %SYSTEMROOT% (e.g., C:\WINDOWS) set to be accessible only by the administrators of the machine (as well as SYSTEM, NETWORK SERVICE, and other pseudo-accounts). In the group policy editor, you specify that one entry, specify that it is inheritable and should rep
    • Finally, I agree with previous posters- an Open Source website is no place to ask random support questions for a closed source OS. /. is a geek news site. Not a F/OSS site.

      And we have people who check stories for appropriateness for the site. They're called editors, and they all work with (or are) the folks who originally made the site.
    • WTF is wrong with windows? Some of you people make it sound like it is the product of Satan.

  • uh... (Score:5, Funny)

    by kayen_telva ( 676872 ) on Monday May 17, 2004 @07:37PM (#9178585)
    dont reboot ??

    oh wait..

  • Microsoft Tech Support. (Score:5, Funny)

    by arcanumas ( 646807 ) on Monday May 17, 2004 @07:38PM (#9178594) Homepage
    Call Microsoft techn support.

    • Call Microsoft techn support.

      Why's this funny? He's got a problem with software that cost a great deal of money, why the hell SHOULDN'T he call tech support? Seems like the first thing he should have done...

      • Re:Microsoft Tech Support. (Score:4, Funny)

        by Spoing ( 152917 ) on Monday May 17, 2004 @09:44PM (#9179427) Homepage
          1. Call Microsoft techn support.

          Why's this funny? He's got a problem with software that cost a great deal of money, why the hell SHOULDN'T he call tech support? Seems like the first thing he should have done...

        LOL! STOP! You're killing me!!!!

      • Better to call Psychic Friends Network (Score:5, Informative)

        by Futurepower(R) ( 558542 ) on Monday May 17, 2004 @10:31PM (#9179701) Homepage

        Those with experience know that if you have a difficult Microsoft technical support question, it is better to ask the Psychic Friends Network [karmak.org]. They don't know the answer either, but they are more friendly and less expensive.

        I've asked 3 questions of MS Tech support recently, and got 0.00 useful answers. For anyone who would like more accuracy in that number, it was 0.00000000000 useful answers.

        Microsoft technical support people not only cannot answer your question, but they are prevented by the Microsoft management hierarchy from communicating with anyone who would know the answer.

        Also, permissions policy in NTFS has some bugs, apparently. (Mentioned by someone else, earlier. I've encountered quirkiness, also.) There is at least one policy setting in Windows XP that says, "Only works in Windows 2000".

        Often a commercial company will not tell the truth about bugs. That's why I like Open Source people. They are honest about bugs. I reported 3 bugs in the NET USE command in Windows XP, and Microsoft Technical Support refused to do anything about it. Too much paperwork to report bugs, I guess.
        • Because you only asked '3' questions, you can only have 1 significant digit of accuracy, thus you got '0' useful answers. Adding extra digits after the decimal point doesn't add accuracy, it just shows you didn't pay attention in highschool science class.

          Also, as mentioned here often, I believe 'anecdotes is not the plural of data'.

          And given the HUGE deployment of windows 2000 and windows xp vs. the relatively miniscule deployment of it's competitors, I'm willing to wager that the 'bugs' your filed in 'n
          • I'm willing to wager that the 'bugs' your filed in 'net use' were actually screwups on your end, and not product defects. And I'm also willing to wager that they are documented in the MSKB.

            Why would his alleged screwups be in MacroShaft's KnowledgeBase? Boy, talk about covering your bets!

            = 9J =

  • Set up a domain, then set up group policies.

    Done and done.

    • Re:Domain (Score:3, Informative)

      by pnutjam ( 523990 )
      For further clarification I am running an Active Directories domain with a windows 2000 server. I am migrating my workstations from windows 98 to XP.

      The specific applications giving me problems are AutoCAD 2000 (support has been discontinued, owner won't upgrade), and a custom application that writes data to several folders I'd rather it didn't.

      • Re:Domain (Score:5, Informative)

        by BrynM ( 217883 ) * on Monday May 17, 2004 @11:50PM (#9180127) Homepage Journal
        Is the custom app hard coded to those directories? If, by some lucky chance it's not on the C drive, you can have it shared and then map it to a network drive to make it think it's running from the right location (you can mount a local share).

        You may also want to check out this [microsoft.com] MS article about creating junction points. It's the "proper" way to link directories, but don't try anythong too complicated or you will just screw up NTFS. By complicated I mean trying to link different sub-directories inside linked directories.

        While you're at MS, take a close look at LinkD on the 2K Resource Kit. That may be just the ticket for making that custom app run from a server or from a different directory. If you don't have the ResKit, you can grab LinkD and other tools from the free offerings from the ResKit [microsoft.com]. I've used it inside a batch file wrapper for onery custom apps that clients insist on. Be sure to have the batch file un-link the directory at the end or un-link it if it exists at startup. NTFS doesn't like to have a bunch of these around or mangled. Here's the LinkD syntax:

        linkd source [/d] [destination] [/?]

        Where:

        source
        displays the Windows 2000 name targeted by source.
        source [destination]
        links source to destination (target), which can be any valid Windows 2000 directory name, device name, or object name.
        source [/d]
        deletes source, regardless of whether a link to a destination exists for that source.
        /?
        prints this help message. Type linkd /? | more to see all the help text.
        LinkD's syntax is case-insensitive. If a source or destination name contains a space, the name must be surrounded by quotation marks. All characters in both the source and destination names must be in the ASCII character set; usage of Unicode characters is not supported.
        A tool to be careful with, but a handy one.
      • When installing Winhoes XP, Just use FAT32 Instead of NTFS...

  • Mr. Obscure! (Score:5, Informative)

    by delus10n0 ( 524126 ) on Monday May 17, 2004 @07:40PM (#9178614)
    Hey, let's post an Ask Slashdot question asking about Windows XP security/settings, and fail to mention:

    1) What application we're using that requires these settings.

    2) What our user setup is like. Are the users in the "Users" group, or the "Administrators" group? Are they part of the local machine, or a networked setup of users?

    3) Where this application is being installed to. Have we tried other locations? What permissions does it need?

    4) What you are doing exactly to remove permissions; what users/groups?

    Maybe with the details, we can provide a more proper answer. K thanks bye.

    • Re:Mr. Obscure! (Score:3, Interesting)

      by BrynM ( 217883 ) *
      Or even something as simple as whether or not he un-checked "Allow inheritable permissions from parent to propogate to this object". I've found that XP will seem to let the permissions get changed without un-checking this box, but on re-boot the permissions re-propogate. Well hell! That could be the answer - or not. It doesn't always work that way for some reason.

      Maybe that helps... In which case he got what he came looking for no matter how lame we think his question may have been. Maybe we should cut some

      • Re:Mr. Obscure! (Score:3, Insightful)

        by pnutjam ( 523990 )
        Or even something as simple as whether or not he un-checked "Allow inheritable permissions from parent to propogate to this object". I've found that XP will seem to let the permissions get changed without un-checking this box, but on re-boot the permissions re-propogate

        Tried it both ways. I like OSS as much as anybody on slashdot, right now, MS is what feeds the kids.

    • Re:Mr. Obscure! (Score:2, Insightful)

      by mpmansell ( 118934 )
      Upon reading the original question, I doubt that this information is really necessary. He poses a pretty generic scenario and no doubt would like to know how to solve the problem for as large a class of apps as possible.

      Would you actually be capable of answering his question if you had this information, or are you just posing a position to be 'helpful' to those that really can?

  • Use WMI (Score:3, Informative)

    by Ropati ( 111673 ) on Monday May 17, 2004 @07:41PM (#9178621)
    This isn't really a fix, but it is a way around your problem. Set up a script using WMI to change all your permissions, shares and registry entries. Place the script in the startup folder and forget about it.

    Download the script samples and modify as necessary from:
    http://www.microsoft.com/technet/community/ scriptc enter/sampscr.mspx

  • Policy Objects (Score:4, Informative)

    by Oriumpor ( 446718 ) on Monday May 17, 2004 @07:49PM (#9178676) Homepage Journal
    GPO's [activedir.org] are there for this purpose. If you can't afford licensing then I'd say you need to read up on VB scripting. [microsoft.com]

    Don't get me wrong, I'm not saying you need to become a genious in it to do this stuff... but not knowing GPO's and VBS is like not knowing RC's and #!/bin/sh.

  • Login script (Score:2, Informative)

    by Chester K ( 145560 )
    Create a login script to reapply the necessary security settings (WMI/VBScript) each time a user logs in. You might only need it every reboot, but the user has to log in after a reboot, so this approach should cover all the bases.
    • This is something I've considered, but I'm the type who likes to why things are happening, not work around them, this is a a last resort, IMHO, but a better alternative the allowing user's to run as local admins.

  • VMWare (Score:3, Interesting)

    by Molina the Bofh ( 99621 ) on Monday May 17, 2004 @08:30PM (#9179000) Homepage
    Why don't you try running it in VMWare?

    In case you don't know, it will allow you to run a completely virtual machine. You can run Linux, 98, NT, XP, whatever you want, even simultaneously. The nice thing is that you can even take a snapshot and easily restore the whole system to the exact point when you saved it. You can even take a snapshot of a booted system, and when you restore it, it'll already be booted.

  • The company I work for uses Netifice as it's VPN provider and when you install Netifice SmartWorX on Windows XP Pro it disables the friendly welcome screen and fast user switching. If you try and re-enable this stuff it says the Cisco VPN service is preventing this from being changed. The checkbox that lets you select whether or not users have to use Ctrl-Alt-Delete to logon to the PC is checked and greyed out so the choice cannot be toggled.

    Wish I could tell you more than that. It's a start I guess.

  • An ACTUAL Answer to your question (Score:5, Informative)

    by RGautier ( 749908 ) on Monday May 17, 2004 @09:26PM (#9179338) Homepage
    Likely changes are being made to permissions in the registry permissions on your machine due to security policy, which is implemented on the machine when it is turned on. You'll want to edit things that you want to change in the Control Panel, under Administrative Tools, in the icon that says "Local Security Policy" and I apologize for my compatriots who have been less than kind...

  • Something is wrong here. (Score:5, Informative)

    by obeythefist ( 719316 ) on Monday May 17, 2004 @09:31PM (#9179371) Journal
    When I first read this ask-for-help I thought it was a linux guy having a troll.

    I've modified permissions on files, folders, and registry keys. Whenever a computer with the modifications is rebooted, the permissions revert to their previous settings.

    Windows does not alter ACL's (access control lists) on files or folders at boot time. It is possible that you or someone else has configured a startup process or logon script (under Win2X active directory, computers can have logon scripts) that repermissions folders or files. I suggest either a full audit of the logon process or a rebuild to a standard windows (with latest patches, see www.windowsupdate.com).

    Registry settings by default are not altered by the startup/shutdown process, but again there may be a group policy or logon script attached to the object in AD somehow that is launching a permissioning process, or inheriting a new registry hive, although this is exceedingly unlikely. Again, a complete rebuild would solve this.

    If you do the rebuild and it does not help, check with your application support. From my 7 years of Windows drudgery and experience, 75% or more of "Windows" problems come from third party apps or PEBKACs.

    If you're unwilling to do the build or the application support people can't help you, contact Microsoft. They're very expensive, but they are very good at what they do, despite what the Slashdot crowd would have you believe.
    • Registry settings by default are not altered by the startup/shutdown process, but again there may be a group policy or logon script attached to the object in AD somehow that is launching a permissioning process, or inheriting a new registry hive, although this is exceedingly unlikely. Again, a complete rebuild would solve this.

      Another possible scenario is that the NTUSER.DAT file which stores the user's policy is renamed to NTUSER.MAN. The user can change anything in the registry, but on reboot it will r
      • I didn't think about that, I haven't touched NT4.0 in ages. I imagine that that may still be an issue under Windows XP, especially if it's a member in an NT4.0 domain (remember those, kids?)

        A mandatory profile would explain registry ACL's resetting if the keys are in HKCU, but I don't see how that would effect HKLM or similar keys, and I sure don't see how it could effect file ACL's.

        Either way a clean rebuild would fix this problem, isolating the machine from the Domain would also work (using a local acco
    • If you do the rebuild and it does not help, check with your application support. From my 7 years of Windows drudgery and experience, 75% or more of "Windows" problems come from third party apps or PEBKACs.

      Does that mean that most Microsoft problems would be solved if no one used them for anything? WTF can you do with a M$ OS without any "third party" application? Lookout without a spell check, MSIE? Sure, but by using those first party applications you will end up with a third party like Gator in no time

  • I Had The Same Problem - Google Helped (Score:3, Informative)

    by TheWanderingHermit ( 513872 ) on Monday May 17, 2004 @10:16PM (#9179599)
    I had the same problem -- I had a program that had to be installed by an Administrator, but I had to change the permissions on all the files for certain people and/or groups to use them. My app had to run on Windows XP and 2K.

    I Googled and found out about a command named "cacls". It can be used from the command line to change all the permission settings on any files or folders to allow any users or groups to use it.

    I'll leave it up to others to post more information on this, since I don't have the info in front of me and since this seems like too easy a question for Ask Slashdot (perhaps another Ask SlashGoogle?) -- unless I completely misunderstand the question.

  • experts exchange (Score:3, Informative)

    by Scottarius ( 248487 ) * on Monday May 17, 2004 @10:20PM (#9179623)
    try asking this question at experts exchange [experts-exchange.com]. You'll find people there will be much more helpful with this issue.
  • My place of work solved this any many other problems with Deep Freeze. This has been a godsend. There are some other products, but the names escape me.
  • That feature helps people avoid the complexity of ACL management that NT is capable of but I suspect it might be exactly the thing that resets your changes when rebooting.

    I haven't tested this claim though, this is just a suggestion.

  • use security templates (Score:4, Informative)

    by sahtanax ( 639159 ) <xanathas@y[ ]o.com ['aho' in gap]> on Monday May 17, 2004 @11:48PM (#9180113) Homepage
    start => run => mmc
    file => add snap-in
    add => security templates

    set your file / registry / services info in the template. save it as .inf

    then apply the template
    secedit /configure /cfg myfile.inf /db myfile.sdb /log myfile.log

    that will compile the inf into a sdb [security db], and apply it. any result will be written to the log. by convention...

    sdb location:
    %windir%\security\Database

    logs:
    %windir%\security\logs

    inf:
    %windir%\security\templates ...where "%windir%" is the windows install dir... i.e. C:\windows or C:\winnt

    bonus: the templace [myfile.inf] can then be copied and applied to any other win2k+ workstation /server.

    • forgot to mention... the is different to GPOs [group policy objs in a couple ways...

      1) GPOs require domain auth, and are applied each time the user logs on to the domain [except for cached logons]

      2) GPOs require the server to push down what amounts to a similar inf, which is then applied at each logon [applying once saves you the CPU cycles]

      3) the changes are once-set... i.e. apply the security template once, and you have those settings. apply another sec temp, or a GPO, which contradicts them, and the

  • Blimey?! (Score:1, Flamebait)

    by turgid ( 580780 )
    Microsoft sells this for money? It wants us all to be using this? How is this a useful feature? Why is it designed this way? Why does an OS put obstacles like this in front of its users?
  • I agree with most at slashdot that your delima is confusing. Windows does not overwrite access rights, they are reserved. We will need more details to answer your exact problem.

    But, if you are interested, in another solution, about 8-9 years ago I worked for a non-profit organization. To protect us from overusing licesnes, I created batch files for people to run (instead of directly using the executable). The batch file would look in a boxoffice folder to see if there was a ticket available (e.g. wp51_
  • Bill says, "you can't do that."

    And who are we to argue?

  • batch file (Score:2, Informative)

    by Anonymous Coward
    You can use a batch file that runs when windows starts and use the CACLS command line to change permissions... i havent used CACLS in like 6 months but if you just type it into CMD with no parameters you can get the usage; i dont remember it bein super difficult.
  • I tried to install Quake 3 Gold on my XP Pro PC and even though the installation completed sucessfully, I couldn't get any updates or be able to update my Punkbuster installation because of a 'Default Behavior' on the primary partition.

    Look up Microsoft KB article 326549 for a workaround.

    http://support.microsoft.com/default.aspx?scid= k b; EN-US;326549

    From what I've read, this 'feature' was enabled due to more and more viruses installing them selves and propagating on systems that didn't have a 'read-only
  • To save Wresteling with File Permissions, why not Convert/Re-install windows on a FAT32 Partition Instead of NTFS
  • if you are changing the reg won't you also have to turn off system restore. ( i hope you already tried this...)
  • make it a dating service. i am a 19 year old male linux user looking for a a nice woman to make.... code with.. lol

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close