3

In Windows XP or Windows Server 2003:

I have a laptop configured with software for network-based vulnerability scanning of systems. The reason this is put on a laptop instead of a desktop or server, is to check systems that normally operate independently of a network, or are on remote isolated networks.

Since this laptop's primary purpose entails travel between networks, all users of the system will need access to change the TCP/IP configuration. Within our department, that's not an issue. We're all Administrators on this system for maintenance purposes anyway.

However, we plan on loaning this system out to other departments or organizations from time to time. Obviously, we do not want these other groups to have full privileges on the system if they don't need them. As far as I can tell, the only Administrator-like privilege they should need is to change the IP Address, Subnet Mask, Gateway, and DNS Servers.

How can this be done for Limited Users, without giving them any more privileges from the higher groups?

1
  • You might check this question to see if any of the windows sudo equivalents allow you to specify specific apps a user can run with elevated privileges.
    – Zoredache
    Nov 17, 2010 at 17:39

1 Answer 1

2

I don't have a machine to test whether or not a limited user can double-click pre-configured scripts at the moment. You could create some scripts and add them to the all-users desktop (so they're visible to everyone) and use a netsh command for each of the different networks.

I'm assuming you have to allow them to enter manually instead of dhcp?

This idea would of course mean that you have SOME idea of the networking setups of these various networks.

Examples:

netsh int ip set dns name=”Local Area Connection” source=static addr=192.168.1.1

netshint ip set address name=”Local Area Connection” source=dhcp

Edited to add:

Do you have a Network Configuration Operators Group? Make the local users a part of this group.

2
  • Thanks for the response. However, one of the reasons this issue has come up is because I don't always know the details what networks this system may be connecting to. Sure, a batch script or something could be written that prompts for the necessary input. However, scripts still require that the user have appropriate privileges to the programs that they run, and the functions those programs perform. So, this suggestion - while providing a nice idea for automation - is not useful for this scenario.
    – Iszi
    Nov 17, 2010 at 17:25
  • @Iszi - I added information to my original answer. If that ends up helping you, let me know.
    – GregD
    Nov 17, 2010 at 17:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .