XP in a 95/98 network

[Fred Martin_1]

We've got 80 PCs all running 95/98/ME, with several NT4 file servers. Users need to log in to NT to get access to the file servers but as you might guess, the PCs themselves are not secure.

We've recently introduced a few PCs running XP PRO and we're having an awful time. It seems that you need to be an admin on the PC to install any software etc. something which our users are allowed to do, for the most part. Like adding Acrobat reader, that sort of thing.

However, admin privileges allow the user to mucky-muck with other stuff, including removing the MIS staff's account on the PC, etc.

How are other companies resolving this? We don't have the budget to make the whole place an XP network.

[John-Thomas Gaietto]

Hello,
Well we ran in to similar issues where I work. First I'm assuming you do have an NT domain controller on an NT 4 machine. When the XP workstations we've given these users local Admin (just added their domain group to power users) And since the XP machine is a member of the domain, IS team has Admin to the machines with out having accounts thus fixing the issue with end-users being able to remove IS users. With the users in the local admin group they can add and remove drivers and software. I know this sounds like a security problem, but with 9X and ME all the users (by default) have the software. IF you do not have a Domain, I would configure one of your machines to be a Domain controller this would help you push security polices to all users. I hope this helps and this should be cost effective as well. If it does help please don't forget the points.

[Jon Finley]

We allow MOST of our users to Admin their own workstations. As for the others....

We place them in the Power Users group (so they can install software/printers) then restrict access to certain management tools to only the Admin or Admin group.


Jon

[James D. Booe]

Hi!
Have you tried making them Admin's of their local(machine name)domain? This resolved the problem that you speek of. On each machine in user manager(not at domain controller) we set them to be administrators of their own machine and it was impossible for them to touch the domain Admin's account because when they logged back on to the doamain they were still local admins but couldn't login as administrator. We also found software that wouldn't install as "Power User".
Have Fun!