1

I am a librarian in a rural public library, and as such, am the default IT person (no particular training, just lots of time trying). We have a domain network, and I had some help setting up an image and group policies to control what patrons can/cannot do. I recently set up two new computers as Administrator, then add a Public user when I am done. The problem is, most software requires you to be admin to install, but then only shows up on the desktop for the admin, and does not give an option to be “available to all users.” There must be a simple way to make specific apps, such as Word, Adobe Acrobat, and Photoshop Elements show up on both desktops, even when the machines are assigned to a group such as public.

Is there an easy way to fix this, or do I have to uninstall app, move the machine out of the group, make Public an administrator, reload the apps using Public, and then move machine back into the group . I tried editing permissions as admin by right-clicking and choosing properties and then giving Public (the user id) permissions for the apps in question. No luck.

Also, as long as I am asking dumb questions, how can I make all the group policies appear in the console?

Thanks for your patience with these questions.

1
  • 1
    Copy the desktop icons from the Admin user Desktop folder to the All Users profile Desktop folder (in Documents and Settings).
    – user3914
    Nov 12, 2009 at 21:36

2 Answers 2

3

Good job having your public users run as non-Administrators. You're doing right to do that.

You have multiple items to respond to. I'll start w/ the application shortcuts:

It's unclear what you mean by "moving" machines "into groups". I think you might be talking about Active Directory Organizational Units. Computers can be members of security groups, but I doubt that's what you mean.

You should read-up on the "All Users" profile. In the "All Users" profile (right-click the "Start" button and choose "Explore All Users" to get an Explorer view of the "All Users" profile), there is a "Desktop" and "Start Menu" folder. Items placed into these folders will be visible to all users of the computer.

My guess is that you're installing an application that's placing a shortcut onto the "Administrator" user's personal Desktop. Assuming that the application puts all its files and registry entries into machine-specific areas, you can safely copy (don't move-- copy and delete!) these shortcuts from the "Administrator" desktop to the "All Users" desktop. You don't want to move items from the Administrator's personal desktop to the "All Users" desktop or the resulting shortcut files will retain permissions that will prevent non-Administrator users from executing the programs via the shortcuts. Copy the shortcuts and delete them from their original location.

It sounds like you're creating local users on each computer. In a domain environment you don't need to do this (and, actually, you really shouldn't be). You should be creating users in the domain using "Active Directory Users and Computers" so that the user accounts can be used from any client computer, can have their password centrally managed, etc.

I don't know what you mean by "how can I make all the group policies appear in the console?" If you can clarify and, perhaps post a screenshot, it might be easier to respond. (You may want to post that as another question to keep this one clean and on-topc with the title.)

Edit:

I'm assuming you're using Windows XP client computers. The book you mentioned isn't familiar to me, but I'd caution you that it will probably direct you toward practices that are applicable in peer-to-peer networking environments. You have an Active Directory domain environment, per your question, so some of the techniques in the book probably won't apply.

There are a few points in your comment I wanted to reply to. I'll do it in a quote / response style to cover each point in isolation.

...even though there is a public user on the server, and I can see it from Control Panel/Users...

It sounds like you're looking at "Local Users and Groups" on your client computers. If you've created a user in the Active Directory domain called "Public", for example, you don't need to create a "Public" user in "Local Users and Groups" on each client computer. (That's the point of having an Active Directory domain-- you create user accounts centrally in Active Directory and are freed from creating "Local Users and Groups" on each PC. Imagine a large company w/ thousands of users and computers trying to manage passwords across thousands of instances of "Local Users and Groups.")

Assuming you've joined the client computers to your Active Directory domain, you should be able to click "Options" in the "Classic" logon box such that you're prompted for a username, password, and "Log on to". That third line, "Log on to" will be a list-box from which you can select the client computer's name or the Active Directory domain's name. By choosing the domain's name and entering the "Public" domain user account's name and password you will be able to logon to the client computer w/o having to create any entries in "Local Users and Groups".

Domain user accounts will not be visible in the "Local Users and Groups" control panel on client computers. Anything you're seeing there is coming from that client computer's own user / group database (called the SAM-- Security and Accounts Manager-- database).

I explore all users as you suggest, there is no Public user and therefore no desktop or start folders...

I'm suggesting that you place copies of the application shortcuts that you want to be visible to all users of the computer onto the "Desktop" subfolder of "C:\Documents and Settings\All Users"-- not of the "Public" user's "Documents and Settings" subfolder. By doing this, the shortcuts will be visible to anyone who logs-on to the computer.

As an exercise in understanding the function of the "All Users" desktop folder, try the following:

  • While logged-on as an "Administrator" user on a client computer, right-click and "Explore All Users" on the "Start" button.

  • In the "Explorer" window that opens, navigate to the "Desktop" subfolder of the "All Users" subfolder of the "Documents and Settings" subfolder of the hard disk drive.

  • In that "Desktop" folder, right-click in the right-pane of the "Explorer" window and choose "New" and "Text Document". Name the document file anything you want.

  • Logoff and logon as the "Public" user. Observe that the text document you created above is visible on the desktop. Attempt to delete the file, and, provided the "Public" user really doesn't have "Administrator" rights, you'll see that the file cannot be deleted. Items placed onto the "All Users" desktop are visible to any user who logs-on to the computer, but cannot be modified (deletion is considered a type of modification in this case) by non-Administrator users.

I see that you're in Nebraska. Unfortunately, that's a little outside my greater-Dayton, Ohio metro area service focus. I got my start using computers in my local public library (about 25 years ago) and I've helped out in some public libraries in my professional life. If you were just a wee bit closer (okay-- more than a wee bit) I'd stop by and get you started. >smile<

7
  • Hi Evan- Thank you so much for your detailed answer. The problem that comes to light from this is that even though there is a public user on the server, and I can see it from Control Panel/Users, when I explore all users as you suggest, there is no Public user and therefore no desktop or start folders. I can log on as public, presumably because Active Directory has a user named that. I have a book called Windows XP Networking and Security (first rule of being a librarian...got a problem, get a book :-) so I will look there also. With this info, maybe I can figure out what I'm doing wrong.
    – Pam Soreide
    Nov 16, 2009 at 23:59
  • @Pam: I'll drop an edit on my answer to see if I can help you out a little bit more. Nov 17, 2009 at 1:53
  • Hi again Evan. I am really sorry. This morning I realized that part of my problem is that this particular computer is running Vista. It is my only Vista machine out of 22 or so. All our books on Vista are checked out. I used the Internet to figure out that I could type in c:\documents and settings\all users\Desktop, but it won't let me in. I have to unhide the files? Anyway, this website said that the equivalent folder was Users\Public\Desktop. The apps are all there but still don't show when I log in as Public.
    – Pam Soreide
    Nov 17, 2009 at 18:56
  • Another thing that is in my mind is that the consultant has a folder somewhere on the server that he refers to as the "Environment" I wonder if I need to put them in there? I'm trying to do this on my own (with your generous help) because my funding is cut (I know...everybody's is) and no money for consulting :-( I am so grateful to you for your expertise. I try to document this stuff so I remember next time it comes up!
    – Pam Soreide
    Nov 17, 2009 at 18:59
  • I did remember to right click the group policy header in the console and click "edit" to make all the policies visible. One less frustration today!
    – Pam Soreide
    Nov 17, 2009 at 20:40
0

Certain apps, when you install them, will give an option to "install for all users" or "only for me". It sounds like you may be clicking through the defaults, and I do recall that a few years back a lot of them had "only for me" as the default. Switching this to an "all users" install is really dependent on the app itself and it's installer; sometimes you can do it clean via Add/Remove Programs | Modify, sometimes it's quite a bit stickier. Unfortunately there's no generic approach.

If you have an Active Directory Domain (which it seems you do have) you may find it easier to use software installation policies to manage all of this (I get the impression you're installing manually). That's a whole 'nother story though, and a specific question about how to use software installation policies would get you more benefit.

For viewing group policy you can't really do better than the Group Policy Management Console (GPMC).

I'm likewise somewhat confused by some of the terminology you're using and would apreciate more info.

You must log in to answer this question.