C
Cary W. Shultz
Guest
Good morning!
I have posted this question to both the CRM and to the Terminal Server
newgroups.
Have a client who runs Windows 2003 Enterprise Terminal Server and has the
CRM Client installed. Something like 45 users use this config.
Someone (not me!!!!!!!) made the Domain Users group a member of the local
Administrators group on the TS box. So, yes, anyone can technically shut
down this TS box! Not good. I found this out yesterday while dealing with
a printer issue.
Anyway, I can not make any changes to this as - it is suspected - the reason
for doing this (Domain Users - local Administrators group) was to be able to
manage the CRM client (repair is what I was told).
My question - is it possible to do with CRM what is so often done with other
applications? Meaning, give the users "more access" to something like
C:\Program Files\Microsoft\CRM (or whatever the install path is) and to
C:\TMP and to the registry (probably something like
HKLM\Software\Microsoft\CRM) so that they are "administrators" with respect
to this application but not with respect to the machine?
Apparently this is something that the on-site Administrator wants to
maintain (read: repair CRM when there are issues)....thus, removing Domain
Users is not an option at the moment! He is more than willing to discuss
this...so there is no brick wall there. His concern is being able to repair
CRM when there are issues (never touched CRM so I do not really know what
this means....assuming Add/Remove Programs.....).
I know that this may not be the best idea....anyone have another idea?
I have not looked at the TS box yet. I am pretty sure that there is no GPO
locking down the TS (would not really matter anyway, right?) or anything
else in place that I normally put in place. Very hesitant to implement any
of the "normal things" that we do to a TS box as it is already in production
with several applications installed. So, a bit limited there.
Thanks,
Cary
I have posted this question to both the CRM and to the Terminal Server
newgroups.
Have a client who runs Windows 2003 Enterprise Terminal Server and has the
CRM Client installed. Something like 45 users use this config.
Someone (not me!!!!!!!) made the Domain Users group a member of the local
Administrators group on the TS box. So, yes, anyone can technically shut
down this TS box! Not good. I found this out yesterday while dealing with
a printer issue.
Anyway, I can not make any changes to this as - it is suspected - the reason
for doing this (Domain Users - local Administrators group) was to be able to
manage the CRM client (repair is what I was told).
My question - is it possible to do with CRM what is so often done with other
applications? Meaning, give the users "more access" to something like
C:\Program Files\Microsoft\CRM (or whatever the install path is) and to
C:\TMP and to the registry (probably something like
HKLM\Software\Microsoft\CRM) so that they are "administrators" with respect
to this application but not with respect to the machine?
Apparently this is something that the on-site Administrator wants to
maintain (read: repair CRM when there are issues)....thus, removing Domain
Users is not an option at the moment! He is more than willing to discuss
this...so there is no brick wall there. His concern is being able to repair
CRM when there are issues (never touched CRM so I do not really know what
this means....assuming Add/Remove Programs.....).
I know that this may not be the best idea....anyone have another idea?
I have not looked at the TS box yet. I am pretty sure that there is no GPO
locking down the TS (would not really matter anyway, right?) or anything
else in place that I normally put in place. Very hesitant to implement any
of the "normal things" that we do to a TS box as it is already in production
with several applications installed. So, a bit limited there.
Thanks,
Cary
