best practice: set up a password for vista client approvals?

[Guest FN]

What's a best practice for creating a password that can be used to approve

things at the admin password prompt for users on Vista Business machines

connected to 2003 AD Server? For example, a user needs to install something

that is acceptable to me. I have to walk over to their machine and type in

the admistrator password. I can type in a server domain password or the

password for the local admin account on their machine. What's better?

What's a good best practice? I don't want to type an important domain

password while people are watching. So is there a way to create some

limited access domain account on the server that will only work for these

purposes but not file access (if so how)?

[Guest Anthony [MVP]]

Re: best practice: set up a password for vista client approvals?

 

In your situation the best thing is to create an account that is a local

administrator on the workstations only.

That way, if it is compromised, it only has rights on the workstations.

Anthony,

http://www.airdesk.com

 

"FN" <sendtonewsgrouponly284@this-not-real.com> wrote in message

news:47b3430b$0$6128$4c368faf@roadrunner.com...

> What's a best practice for creating a password that can be used to approve

> things at the admin password prompt for users on Vista Business machines

> connected to 2003 AD Server? For example, a user needs to install

> something that is acceptable to me. I have to walk over to their machine

> and type in the admistrator password. I can type in a server domain

> password or the password for the local admin account on their machine.

> What's better? What's a good best practice? I don't want to type an

> important domain password while people are watching. So is there a way

> to create some limited access domain account on the server that will only

> work for these purposes but not file access (if so how)?

>

[Guest FN]

Re: best practice: set up a password for vista client approvals?

 

Can it be done with a "no real permissions on the server" server account?

The problem with a local user account is that I'd have to remember which

ones apply to which machines at any time.

 

"Anthony [MVP]" <anthony.spam@spammedout.com> wrote in message

news:eNdSV6nbIHA.4696@TK2MSFTNGP05.phx.gbl...

> In your situation the best thing is to create an account that is a local

> administrator on the workstations only.

> That way, if it is compromised, it only has rights on the workstations.

> Anthony,

> http://www.airdesk.com

>

> "FN" <sendtonewsgrouponly284@this-not-real.com> wrote in message

> news:47b3430b$0$6128$4c368faf@roadrunner.com...

>> What's a best practice for creating a password that can be used to

>> approve things at the admin password prompt for users on Vista Business

>> machines connected to 2003 AD Server? For example, a user needs to

>> install something that is acceptable to me. I have to walk over to

>> their machine and type in the admistrator password. I can type in a

>> server domain password or the password for the local admin account on

>> their machine. What's better? What's a good best practice? I don't want

>> to type an important domain password while people are watching. So is

>> there a way to create some limited access domain account on the server

>> that will only work for these purposes but not file access (if so how)?

>>

>

>

[Guest Kerry Brown]

Re: best practice: set up a password for vista client approvals?

 

"FN" <sendtonewsgrouponly284@this-not-real.com> wrote in message

news:47b3b7ba$0$30702$4c368faf@roadrunner.com...

> Can it be done with a "no real permissions on the server" server account?

> The problem with a local user account is that I'd have to remember which

> ones apply to which machines at any time.

>

 

 

Create a domain user that has the minimum permissions needed on the server

for this purpose then add that user to the local administrator group.

 

--

Kerry Brown

Microsoft MVP - Shell/User

http://www.vistahelp.ca/phpBB2/

[Guest Anthony [MVP]]

Re: best practice: set up a password for vista client approvals?

 

Yes, create a domain user with the local admin rights I mentioned.

You can use Restricted Groups policy to put this account automatically in

the Local Administrators group,

Anthony,

http://www.airdesk.com

 

 

"FN" <sendtonewsgrouponly284@this-not-real.com> wrote in message

news:47b3b7ba$0$30702$4c368faf@roadrunner.com...

> Can it be done with a "no real permissions on the server" server account?

> The problem with a local user account is that I'd have to remember which

> ones apply to which machines at any time.

>

> "Anthony [MVP]" <anthony.spam@spammedout.com> wrote in message

> news:eNdSV6nbIHA.4696@TK2MSFTNGP05.phx.gbl...

>> In your situation the best thing is to create an account that is a local

>> administrator on the workstations only.

>> That way, if it is compromised, it only has rights on the workstations.

>> Anthony,

>> http://www.airdesk.com

>>

>> "FN" <sendtonewsgrouponly284@this-not-real.com> wrote in message

>> news:47b3430b$0$6128$4c368faf@roadrunner.com...

>>> What's a best practice for creating a password that can be used to

>>> approve things at the admin password prompt for users on Vista Business

>>> machines connected to 2003 AD Server? For example, a user needs to

>>> install something that is acceptable to me. I have to walk over to

>>> their machine and type in the admistrator password. I can type in a

>>> server domain password or the password for the local admin account on

>>> their machine. What's better? What's a good best practice? I don't

>>> want to type an important domain password while people are watching.

>>> So is there a way to create some limited access domain account on the

>>> server that will only work for these purposes but not file access (if so

>>> how)?

>>>

>>

>>

>

>