Explanation of users rights on XP


Target audience: Lab faculty

To login to Windows XP you have to belong to a group that has been granted local logon rights. Many groups exist on a XP system right out of the box with varying levels of access. This is how Microsoft controls the security on the computer. A user may belong to more than one group. This offers a fine grained approach to managing computer resources. A user that is in the base group "users" has very little access to the operating system itself. BTW all disd users belong to "users". They cannot add or remove printers, change the system time or date or perform many other functions. They can run any well written program designed for XP. They cannot install this software, an administrator, one who belongs to the group administrators, can install software. Where we run into problems is when we try to use software that has not been designed for XP. When a nonprivileged user from the group users attempts to run such software they will either have no icons or the program will generate some generic message indicating it is not going to cooperate. Hence my reason for writing this. At some point your going to install software that will not run for your students.

At this point you can reference the following link to build icons for all users to see.

Two things that I know of can be done to set the machine so all users can run the problem software. One is to set the folder and file permissions on files that the program accesses, or to give the students more privileges. The first solution is more secure as you almost have to promote the students to administrator level to achieve this. This means they can now tear up your machines at will.

I'll explain both methods, remember choice two is a last resort choice, after all it is your lab.

While doing the software install write down the default installation directory, this information is ALWAYS displayed during install.
Open Windows explorer while logged in with an Admin account.
Click tools/folder options
Click view
Un-check simple file sharing
Click apply, this opened up things so you can now see the security settings when selecting properties.
Find the software location (you did write this down correct?)
Right click the folder and select properties.
Click the security tab.
Click add
Enter "everyone" in the "Enter the object names to select" box.
Find and highlight everyone in the "group or usernames" box.
Examine the permissions for this user, default should be read & execute, list and read. You may have to up these to full to make the program run. I would try things as is first.

Adjust a groups privilege to a higher level for program access:

Open the Control Panel
Click Administrative Tools
Click Computer Management
Click the + sign next the Local Users and Groups
Click on Groups
Double Click Power users