Re: Login Script by Jeff
Jeff
Mon Jul 21 12:53:09 CDT 2003
Well, this is where the conversation departs from discussion of logon
scripts and goes to a discussion of general security issues. In practice, it
is very difficult to run most LANs with all Administrator privileges remove
for all users, too much application software doesn't run this way at this
time.
You might look at a thread I started a few weeks back.
6/25/03 "Comments" Should SBS sites be 100% Locked Down, Scripted Installs?"
You will see where my thinking is on this. It's not pretty.
"Chris Guimbellot" <cguimbellot@hifranchise.com> wrote in message
news:uZxMwRXTDHA.2228@tk2msftngp13.phx.gbl...
> Jeff,
>
> Thanks for the help. I usually deploy software via Group Policy, so I
could
> really go without the SBSCLNT.exe at login. I guess what I would really
like
> to know is why it doesn't run. It worked fine under NT, but then, each
user
> was an Administrator of his own PC. I don't think a user should have those
> rights. Also, on the subject, I have noticed that many of the users have
had
> problems downloading and installing plugins like Virtual Machine on their
> PCs. It seems related to the other problem. Basically, I just want the
users
> to have as much power as necessary to do their jobs and that's it. I don't
> understand this. Any ideas? Thanks,
>
> Chris
>
> "Jeff Middleton [SBS-MVP]" <jeff@cfisolutions.com> wrote in message
> news:uvyBIyVTDHA.3116@TK2MSFTNGP10.phx.gbl...
> > If you don't deploy applications via the logon script for regular users,
> you
> > don't need that command line in their logon scripts. If you don't need
> your
> > users as members of the Administrator group for any reason you have a
> > preference for, you should undo the Authenticated Users entry you just
> added
> > to the Administrators Group at each local desktop.
> >
> > If you want to run the SBS logon script for an administrator to deploy
> > software from time to time, just leave that command in their logon
script
> > alone.
> >
> >
> > "Chris Guimbellot" <cguimbellot@hifranchise.com> wrote in message
> > news:e4f0MsVTDHA.2480@tk2msftngp13.phx.gbl...
> > > SBS2K, Win2K clients.
> > >
> > > I performed my first push to Win2000 over the weekend. Of course I am
> now
> > > working out a few kinks. One problem I am having is that for some
users,
> > > when the SBS_Login_Script.bat runs the SBSCLNT.exe app, the command
> prompt
> > > window it opens just sits there forever. If I CTRL + ALT + DEL out of
> it,
> > > when the desktop loads, the company and user folders are there and
> > > everything seems to be okay. Also, I am running user login scripts via
> > Group
> > > Policy to connect to printers, and those work okay too. I figured that
> the
> > > problem was that the users did not have the correct permissions to run
> the
> > > application. When I configured the computers, I did not add the
specific
> > > user of that PC to the local Admins group. To try to get around the
> > problem
> > > running that app, I assigned that Authenticated Users group to the
Local
> > > Admins group. The program runs fine now, but here is my question: if
> you
> > > are deploying apps and other settings via Group Policy, is it still
> > > necessary to have users run the SBS_Login_Script.bat and the
> SBSCLNT.exe?
> > I
> > > would, however, like to keep the company and the user's folder on the
> > > desktop.
> > >
> > > Any ideas would be most appreciated. Thanks,
> > >
> > > Chris
> > >
> > >
> >
> >
>
>