Domain Users, Local Permissions, and Outlook

[Matt-at-anw]

"I was basically asking if your ACLS within your GPO have any reqs for Outlook at all. Or basically are there any rules you have set for outlook at all on the domain ?"

Nope. We are using MS Exchange, but I don't know if that is relevent.

We've only tested on one machine so far.

 

[brady]

Exchange is a given ... That doesn't really answer that question.

 

[Win2kpatcher]

Hi all,

Our network setup currently has users logging in as domain users, and they are all local administrators on their own computers. We wanted to restrict them to limited or power users, but when we did this on a computer, we got a message when trying to open Outlook 2003 that said "Cannot open Microsoft Office Outlook." Are we missing permissions somewhere? Is there a conflict problem with the domain settings? Anyone have any ideas?

Thanks,

Matt

Can you clarify..first you say you have them as local admins, but then you say they are limited or power users...which are they on the local machine.thanks.

 

[Matt-at-anw]

Re: Re: Domain Users, Local Permissions, and Outlook

Can you clarify..first you say you have them as local admins, but then you say they are limited or power users...which are they on the local machine.thanks.

The other computers are currently configured as local administrators, and they work fine. The computer that is having issues is the one that we set as a power user.

 

[Win2kpatcher]

that is probably it. set it to local admin and reboot and see if it fixes the problem. If it does then we can control his permission from the active directory level via a policy and block out the items you wanted to block out. You can PM me if you wish for details on how to do this or I can post here to that is fine.

 

[Matt-at-anw]

We use GPO to restrict most things. Is there an option in GPO to make domain users similar (in permissions) to restricted users? We don't want to allow downloads/installations due to the amount of virus problems we've had with the sales staff over here.

Thanks

 

[Win2kpatcher]

Yes you can do this easily. If I was you I would create a seperate GPO and place this user in it. In the policy ( now if I recall the XP local policy and server 2003 policy are pretty similiar so these instructions should be close enough).

Go to USER CONFIGURATION>ADMINISTRATIVE TEMPLATES>INTERNET EXPLORER>INTERNET CONTROL PANEL>SECURITY PAGE>LOCKED-DOWN LOCAL MACHINE ZONE, then disable-allow file downloads. In the IE area you can also prevent SAVE-AS dialog boxes..prevent changing home pages..GPO rules!!