ms login group 3 = full access?

sgt-d · Post by **sgt-d** » 2005-04-09 16:40

i am running two global groups on my nt4 domain controller, vncadmins and vncusers.

for that machine and for win9x clients in that domain i am using ms login (not ms login ii).

in ms login, the 1st group is set to vncadmins (all caps), the 2nd group is intentionally left blank and the 3rd group is set to vncusers (all caps).

the problem is that any user in the vncadmins or vncusers group is granted full access, even though members of the vncusers group should be restricted to view only (based on the information on the ms login dialog text/help).

can anyone else confirm this behavior?

-sgt

Post by **Rudi De Vos** » 2005-04-09 16:55

Try to remove authadmin.dll if the client is win9.x

+This grant access to local admins, could be a prob on 9.x
+Check if user is not in the 2 groups

sgt-d · Post by **sgt-d** » 2005-04-09 17:54

on the win9x box i moved authadmin.dll out of the ultravnc folder and restarted the service - i then logged in with the test account again - but i still had full access. the test user account is only in the vncusers group, and vncusers is only in group 3 of ms login.

merv · Post by **merv** » 2005-06-02 16:45

I'm having the same problem too, not only with Win9x but also with Win NT...

I'm using MS-Logon I for my NT systems in a Windows 2000 domain.

I know that I could have used MS-Logon II but there is too much trouble for me to upgrade all of my clients with the Security Configuration Manager and the latest IE, as I'm trying a remote installation here.

The 3rd group View-Only access doesn't seem to work as the group that I set here is granted full-access. I've tried both local and domain groups (non-admin) for the 3rd group and they end up having full-access instead of view-only. None of the users in group 3 are members of groups 1 and 2.

The latest UltraVNC version was used. I believe it's RC20.5.

Marscha · Post by **Marscha** » 2005-06-03 06:02

For MS-Logon II it's not really neccessary to have the Security Configuration Manager installed on NT4.
You need SCM only if you want to use the GUI for security groups configuration ("Configure MS-Logon groups").
If you use MSLogonACL, you can do without SCM.

merv · Post by **merv** » 2005-06-03 08:31

Thanks Marscha.

I tried to import a pre-edited ACL.TXT file using MSLogonACL and it worked without requiring an installation of SCM.