Rights to edit Registry (W2K)

[AMJ2]

I have users that I don't wish to give full admin rights to their Win2k PCs. They run a program (Attachmate-EXTRA!) that tries to write to the registry every time they run it. They always get an annoying error message "failed to update system registry" every time they run it. The error goes away when they hit OK and the program continues normally. I tried giving them Administrator rights to run it and then took the rights back, but the error message came back again.
How can I give them rights to the registry enough to avoid this error message from popping up? I don't want to use the run as feature nor does it help here.

Thanks in advance.

[justinr]

Hi,

Assuming that your users are either "Guests or Users" then this would explain why. If so, then add the following users to the "Power User"group.

Alternatively, assuming again, that they are all Power Users, then place the following registry entry under the HKEY_Local MACHINE DIRECTORY\ etc....in this way, it would affect all users. Im guessing that the registry message is located under the "HKEY_USERS" directory as this would also explain why, that each user has to update it under his or her account with minimal or no rights.

Another possible answer, could be that the fact that they (users)have installed the program under their accounts and this would be why they continue to recieve the error message rather than having it installed from the Administrator account.


Try logging on as Admin, and then right click the program. Under "Security" add the users to have full control of the program and add short cut.

Hope this help

[AMJ2]

Thanks for the insight. The program was installed under the admin account. The users are only members of the users' local group. I don't want to give them more than that if I can. I think, for a fact, that the program tries to write something to the registry every time it runs. It does that always (not just once) when you run it. Where and what does it write in the registry? Don't know. I wonder if I can track/audit it or maybe if the event viewer would show any detailed info. Then maybe I can give them explicit rights to the one key/sub key through REGEDT32.

Any ideas?
AMJ2

[justinr]

Ok,

Why not test by using one of the user's account and add him or her to the "Power Users" group. Then run the program. If all's well, then decide to disable the registry.

Although, this would in turn affect all users; including Administrator. At least your users don't need to access the registry; only you will decide when it's essential.

Eventually, its no harm adding users to the Power Users group; as this is the default for Win2000 and they [users] also have some limitations.

Lastly, hide the "run" menu if you don't want to disable the registry.

Hope this is of any use to you! If not, then I suggest to wait for a better soultion.

[apastuhov]

I usually use RegMon (downloadable from "http://www.sysinternals.com/") to either monitor successfull updates to the registry when you run the program as an administrator or unsuccessull attempts when you run it as a user.

This gives you a list of registry keys you need to relax the security on for the users to be able to do what they need.

To actually update the permissions you can use a tool I wrote downloadable from "http://members.optushome.com.au/apastuhov/WindowsRegistryCommander.htm".

Regards,
Alex.