Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In Windows XP or Windows Server 2003:

I have a laptop configured with software for network-based vulnerability scanning of systems. The reason this is put on a laptop instead of a desktop or server, is to check systems that normally operate independently of a network, or are on remote isolated networks.

Since this laptop's primary purpose entails travel between networks, all users of the system will need access to change the TCP/IP configuration. Within our department, that's not an issue. We're all Administrators on this system for maintenance purposes anyway.

However, we plan on loaning this system out to other departments or organizations from time to time. Obviously, we do not want these other groups to have full privileges on the system if they don't need them. As far as I can tell, the only Administrator-like privilege they should need is to change the IP Address, Subnet Mask, Gateway, and DNS Servers.

How can this be done for Limited Users, without giving them any more privileges from the higher groups?

share|improve this question
    
You might check this question to see if any of the windows sudo equivalents allow you to specify specific apps a user can run with elevated privileges. –  Zoredache Nov 17 '10 at 17:39

1 Answer 1

up vote 2 down vote accepted

I don't have a machine to test whether or not a limited user can double-click pre-configured scripts at the moment. You could create some scripts and add them to the all-users desktop (so they're visible to everyone) and use a netsh command for each of the different networks.

I'm assuming you have to allow them to enter manually instead of dhcp?

This idea would of course mean that you have SOME idea of the networking setups of these various networks.

Examples:

netsh int ip set dns name=”Local Area Connection” source=static addr=192.168.1.1

netshint ip set address name=”Local Area Connection” source=dhcp

Edited to add:

Do you have a Network Configuration Operators Group? Make the local users a part of this group.

share|improve this answer
    
Thanks for the response. However, one of the reasons this issue has come up is because I don't always know the details what networks this system may be connecting to. Sure, a batch script or something could be written that prompts for the necessary input. However, scripts still require that the user have appropriate privileges to the programs that they run, and the functions those programs perform. So, this suggestion - while providing a nice idea for automation - is not useful for this scenario. –  Iszi Nov 17 '10 at 17:25
    
@Iszi - I added information to my original answer. If that ends up helping you, let me know. –  GregD Nov 17 '10 at 17:40
    
That looks better now. Thanks! –  Iszi Nov 17 '10 at 18:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.