Windows XP SP2 And groups

Arbeider · Post by **Arbeider** » 2004-09-24 05:46

Hi there,

A friend of mine and me are trying to establish a connection via Ultr@VNC RC18 en the new MSLogon. The get the connection is not the problem. But it wont authenticate. I used machine\group en just group, neither worked. The account used is valid because it can logon locally on the system. Both system run Windows XP Professional SP2. When I use the normal MSLogon the authentication goes wel. Only then the problem is the even if I use a groupname in option 3 (View Only), you still have full control.

Could you guys help me out a bit?

Thx.

Guest · Post by **Guest** » 2004-09-24 07:25

Mslogon always give full access on local sysadmins
If you use group3, but user is also local admin, he still have full access.

Arbeider · Post by **Arbeider** » 2004-09-24 17:03

Well, Th egroup I created is called UltraVNC. There are two users in it. One is local Admin the other is a normal user. When the normal users logs on he too has full access. I tried it with only a regular user in the group, same problem, still full access.

Post by **Rudi De Vos** » 2004-09-24 21:44

XP home ?
Restricted user ? notmal user ?
XP home give admin access to all normal users.

Arbeider · Post by **Arbeider** » 2004-09-27 13:35

Hi Rudi, In my first post I said both system use WinXP Pro SP2.
The user in the group is a normal user. Even if I use guest account it still has full access.

ipsec · Post by **ipsec** » 2004-09-27 16:16

Arbeider wrote:Well, Th egroup I created is called UltraVNC. There are two users in it. One is local Admin the other is a normal user. When the normal users logs on he too has full access. I tried it with only a regular user in the group, same problem, still full access.

You need to have two Seperate groups.

One - UltraVNCAdmin
Two - UltraVNCUser

Put the admin in the Admin group, user in the user group.

Specify on group 3 on the ms logon UltraVNCUser group and you should be good to go.

You were really close

Arbeider · Post by **Arbeider** » 2004-09-28 05:57

Thx IPSec, I will try this tonight (It's now 7:57 am). So if I'm correct this is what happens. If there's a group that has a local admin in it (and is set in option 3 in mslogon) all the other users (even guests) in that group have full access too?

Because that's what's happening to me. But again, tonight I will try what you suggested.

ipsec · Post by **ipsec** » 2004-09-28 22:18

Basically what I think is occuring is the following -

Since you only had one group (Ultra VNC) because you had to put that group name in both the MS logon 1 and 3 you are basically saying give them full and view only access.

It gave the Group the highest access available which is full control... It didnt matter what the actual users privelages were because it was part of that single group.

If you seperate the groups - e.g. VNCAdmin / VNCUser. Specify the admin for the admin group and the person in the user group. You can now explicitly state

VNCAdmin to have full access under the MSLogon 1 or 2 groups and VNCUser under the number 3 (Read Only) group.

That would segregate the distinction in the program for you by group rather than sharing the one Ultra VNC group

Hope that makes sense... but if it doesnt just create two groups, put the admin in one, the user in another and try it.. I think thats what you are going for.

Arbeider · Post by **Arbeider** » 2004-09-29 07:06

Hi there,

No IPSec, I never put the same group in 1 and 3.

I tried the following last night: I created a group called ViewVNC and I added a user Mark in it. I removed Mark as a regular user so the only group Mark is in is ViewVNC. This group I put under 3 in the Microsoft Logon, so it should be View Only. But it still has Full Access. I'm not using a domain so maybe there's a problem with that. I only enable local on group 3 which is ViewVNC. Are there any registry settings I need to change? Does this only work with MS Logon V2?

AAARGGGGHHHH!!!! (Sry, just needed to cool off)

Marscha · Post by **Marscha** » 2004-09-29 08:29

I don't know if this is good news or bad news for you, but I'm working on version 3 of the new mslogon.
This will allow for configuration of any number of groups/users.
You can set any group/user to view only.
The config window is just the familiar security property page that is also used with any other securable object in Windows:

This should work under NT4, W2K, WXP and W2K3 in service mode.
I'll then try to extend this to app mode and W9x.

Arbeider · Post by **Arbeider** » 2004-09-29 09:25

Thx,

Keep us posted when there's a test version of V3. I would really like to test since the current mslogon appears not to function in my case. Or do you have any suggestions (if so please in detail).

greetz