locked
Limiting commit changes ability RRS feed

  • Question

  • I want to have my users to be able to install printers, applications, and hardware if they have to.  But I don't want them to make the changes permanent.  The computers are on a domain, but I have installed Steady State from a local Administrator account.  The users use their domain credentials to log in and all are members of a shared group.  I looks like the only way I have been able to prevent them from committing changes is disabling the warning window in the disk protection. 

    Is there a way that I can give only the local administrator the popup window to commit changes and no other users?  While at the same time allowing the users logging in to install, albeit temporarily, programs?
    Friday, March 21, 2008 11:07 PM

Answers

  •  

    Hi Wyrmul,

     

    Thank you for posting here!

     

    From the post, I understand that you would like to allow domain users to install programs and hardware and do not allow permanent changes. You would like to know if we can disable the WDP notification window for other users after the user makes change and logs off.

     

    Wyrmul, I suggest we add those users to power user group. Users in this group will not receive the warning message from WDP. Also, users in Power User group can install programs as you described. Let's see if this meets your need. If you need detail information on how to set power users, please feel free to let me know.

     

    Best regards,

    Monday, March 24, 2008 9:04 AM

All replies

  •  

    Hi Wyrmul,

     

    Thank you for posting here!

     

    From the post, I understand that you would like to allow domain users to install programs and hardware and do not allow permanent changes. You would like to know if we can disable the WDP notification window for other users after the user makes change and logs off.

     

    Wyrmul, I suggest we add those users to power user group. Users in this group will not receive the warning message from WDP. Also, users in Power User group can install programs as you described. Let's see if this meets your need. If you need detail information on how to set power users, please feel free to let me know.

     

    Best regards,

    Monday, March 24, 2008 9:04 AM
  • Unfortunately the Power Users group does not allow the user to install all the potential software that they may use.  Specificly accessability software that may create services or other system changes.  We have laptops and computers that are checked out by users with special needs.  We need them to be able to install any software and then have it go away when they are done.  And preferably not give them the option of commiting changes.  Is there a way to turn off and on Commit Changes Notification? 
    Tuesday, March 25, 2008 9:44 PM
  • Hi Wyrmul,

     

    Thanks for the update.

     

    Though we cannot turn off the notification for normal administrator users, I would like to suggest to use "Restricted Administrator" account as a workaround. (In this way, the notification only appears 5 seconds instead of 1 minute as a un-restricted Administrator.) This can be completed easily in SteadyState. Let's see if this can fulfill your need.

     

    Creating a Restricted Shared Administrative Account

    For users to run applications that are not designed to run on Windows XP, a restricted shared administrative account can be created for the purpose of operating nonstandard software, such as Internet-based and network-based multiplayer games. Some older educational programs also require more administrative access than is allowed with a typical Windows SteadyState user account with a restricted shared user profile.

    For a list of non-Microsoft programs that do not work with typical Windows SteadyState shared user accounts, see Microsoft Knowledge Base Article #307091 at:                       http://go.microsoft.com/fwlink/?LinkId=83434.

    A restricted shared administrative account is an unlocked user profile in which most restrictions have been removed. This type of unrestricted user account allows access to the increased permissions necessary to run nonstandard applications.

     

               To add a shared user account to the Administrators group on the computer

    1.   Log on as the Windows SteadyState administrator. You must also be logged on as an administrator or a member of the Administrators group to add a shared user account to the Administrators group on the computer.

    2.   Click Start, and then click Control Panel.

    3.   In Control Panel, double-click User Accounts.

    4.   On the Users tab, under Users for this computer, click the shared user account that you want to add to the Administrators group, and then click Properties.

    5.   On the Group Membership tab, select the Other option, choose Administrators from the drop-down list, and then click OK.

     

    After the shared user account has been added to the Administrators group, use Windows SteadyState to restrict the shared administrative account access to all programs and settings, with the exception of the increased permissions that are necessary to run nonstandard applications.

     

    For more detailed information, please refer to SteadyState handbook:

     

    Windows SteadyState Handbook

    http://www.microsoft.com/downloads/details.aspx?FamilyId=D64AF114-336C-4418-BEB7-E074E813B498&displaylang=en

     

    Best regards,

    Wednesday, March 26, 2008 7:01 AM
  • Unfortunately the accounts I need to remove the ability to commit changes from are not Local accounts but Domain accounts.  As far as I can tell I cannot create a user that's settings encompases a domain group. 

    So there is no way to give a Domain Group full administrative rights to install hardware and programs but not the ability to commit changes?
    Wednesday, March 26, 2008 9:19 PM