Giving full access to program files folder

[Guest Yobbo]

Hi All

 

I work in primary schools and unfortunately this means that I have to deal

with the varied and bizarre world of educational software!

 

A lot of this software won't work if the folders don't have read/write

access so my plan has been that I give domain users full control to the

Program Files (and sub-folders). To try and protect the folder I have

hidden the C drive from the kids ( 3 - 7 year olds) via GPO and everything

seems to be fine, but I just wanted to check if I have dropped a monumental

boo-boo by doing this.

 

Any comments/thoughts on this?

 

Thanks

[Guest CraigB]

RE: Giving full access to program files folder

 

Not the best idea in my opinion. You might have been better off giving only

the permissions necessary to run the program to that folder and subfolders.

In other words instead of giving domain users full control you give only

read/write, maybe. I know its more work, but I am not a fan of general

solution to fix specific problems. XP also has a built-in solution for

dealing with this, the Application Compatibility Engine. Using it with the

Application Compatibility Toolkit you can redirect writes to protected areas

to the user’s profile.

 

This article on Microsoft Application Compatibility Toolkit (I believe that

V 4.1 is out) might help: http://support.microsoft.com/kb/895129/en-us

although I have not used it myself. Also this:

http://www.windowsitpro.com/Article/ArticleID/94241/94241.html

 

--

Craig

MBA-MIS, MCP, MCSA, MCSE, CCA

 

 

"Yobbo" wrote:

> Hi All

>

> I work in primary schools and unfortunately this means that I have to deal

> with the varied and bizarre world of educational software!

>

> A lot of this software won't work if the folders don't have read/write

> access so my plan has been that I give domain users full control to the

> Program Files (and sub-folders). To try and protect the folder I have

> hidden the C drive from the kids ( 3 - 7 year olds) via GPO and everything

> seems to be fine, but I just wanted to check if I have dropped a monumental

> boo-boo by doing this.

>

> Any comments/thoughts on this?

>

> Thanks

>

>

>

[Guest Richard Mueller [MVP]]

Re: Giving full access to program files folder

 

Another option might be to install these applications somehere other the

"Program Files".

 

--

Richard Mueller

Microsoft MVP Scripting and ADSI

Hilltop Lab - http://www.rlmueller.net

--

 

"CraigB" <CraigB@discussions.microsoft.com> wrote in message

news:91801AA8-292B-4128-8D5A-4053BCEB7E75@microsoft.com...

> Not the best idea in my opinion. You might have been better off giving

> only

> the permissions necessary to run the program to that folder and

> subfolders.

> In other words instead of giving domain users full control you give only

> read/write, maybe. I know its more work, but I am not a fan of general

> solution to fix specific problems. XP also has a built-in solution for

> dealing with this, the Application Compatibility Engine. Using it with

> the

> Application Compatibility Toolkit you can redirect writes to protected

> areas

> to the user’s profile.

>

> This article on Microsoft Application Compatibility Toolkit (I believe

> that

> V 4.1 is out) might help: http://support.microsoft.com/kb/895129/en-us

> although I have not used it myself. Also this:

> http://www.windowsitpro.com/Article/ArticleID/94241/94241.html

>

> --

> Craig

> MBA-MIS, MCP, MCSA, MCSE, CCA

>

>

> "Yobbo" wrote:

>

>> Hi All

>>

>> I work in primary schools and unfortunately this means that I have to

>> deal

>> with the varied and bizarre world of educational software!

>>

>> A lot of this software won't work if the folders don't have read/write

>> access so my plan has been that I give domain users full control to the

>> Program Files (and sub-folders). To try and protect the folder I have

>> hidden the C drive from the kids ( 3 - 7 year olds) via GPO and

>> everything

>> seems to be fine, but I just wanted to check if I have dropped a

>> monumental

>> boo-boo by doing this.

>>

>> Any comments/thoughts on this?

>>

>> Thanks

>>

>>

>>