Disable server admin capabilities

Terriff · Post by **Terriff** » 2005-08-16 21:26

How about the ability to remove the VNC server admin properties from users?

Ideally, this would be set via network group policies, but for those without group policy environments, perhaps there could be a registry setting or something that would remove the admin capabilities.

This has come up as we would like to have the VNC system tray icon available, but don't want the users messing with the pushed out server settings.

Any suggestions?

Thanks.

redge · Post by **redge** » 2005-08-16 21:38

Winvnc... Admin properties... Misc
[X] Disable Client Options in tray icon menu

valid for user limited access level
but if user have administrator level access that have no effect until a Group Policies disable his right access locally or remotely.

Terriff · Post by **Terriff** » 2005-08-16 22:24

So, what setting is required to be set in a Group Policy to remove the admin properties?

Scosuz · Post by **Scosuz** » 2005-09-23 16:37

I would like the answer for this as well. For the same reasons. I wish to see the icon in system tray, but remove ADMIN PROPERTIES from being accessed.

Regedit would be ideal.

One to remove, one to grant.

Post by **Rudi De Vos** » 2005-09-23 17:11

Admin properties.

Vnc check if the user has access to manage the service manager.
Current use can manipulate services --> admin props
no access->admin probs disabled.

If a user see the admin properties, he always can change and overwrite them via other methods.

Granting "service manager access" is granting full controle to the PC.

There is a registry setting that block changes for everybody, including admin.
Once set, only registry can be used to unset.
check
Alloweditproperties

merwinb · Post by **merwinb** » 2005-09-23 17:22

Rudi De Vos wrote:Admin properties.

Vnc check if the user has access to manage the service manager.
Current use can manipulate services --> admin props
no access->admin probs disabled.

If a user see the admin properties, he always can change and overwrite them via other methods.

Granting "service manager access" is granting full controle to the PC.

There is a registry setting that block changes for everybody, including admin.
Once set, only registry can be used to unset.
check
Alloweditproperties

Terrif,

Once these settings are configured the way you want in the registry, you can go a step further and block access to them via group policy.

I haven't had much trouble there - I just still can't build a decent MSI file that works correctly.

-Brian

Terriff · Post by **Terriff** » 2005-09-23 17:23

Rudi De Vos wrote:...There is a registry setting that block changes for everybody, including admin.
Once set, only registry can be used to unset.
check
Alloweditproperties

So, what is the registry key and setting to achieve this? "AllowEditProperties? Is it a DWORD? What registry key does it need to be under?

Thanks.

Post by **Rudi De Vos** » 2005-09-23 17:26

[HKEY_LOCAL_MACHINE\SOFTWARE\ORL\WinVNC3\Default]
"AllowShutdown"=dword:00000001
"AllowProperties"=dword:00000001
"AllowEditClients"=dword:00000001

1 Allow
0 deny

Terriff · Post by **Terriff** » 2005-09-23 21:58

Perfect! That's what I needed.

Thanks!

scosuz · Post by **scosuz** » 2005-09-25 00:06

Worked fine Rudi, thanks. I made reg files to allow and deny.