How to allow users to manage file and print shares without granting other advanced privileges

Table of contents, Aaron Margosis' non-admin blog

Aaron Margosis' WebLog — Tue, 19 Apr 2005 03:22:46 GMT

Complete list of Aaron Margosis' non-admin / least privilege posts, for easy lookup.

More non-admin tips from Aaron

Thu, 28 Apr 2005 17:05:26 GMT

How to allow users to manage file and print shares without granting other advanced privileges
http://blogs.msdn.com/aaron_margosis/archive/2005/04/18/409105.aspx&nbsp...

Spread the LUA joy

tonyso — Fri, 10 Jun 2005 19:12:48 GMT

Get your friends and family, all those folks that come to you for computer help once their machines have...

re: How to allow users to manage file and print shares without granting other advanced privileges

Jon Morningstar — Fri, 22 Jul 2005 00:28:48 GMT

Do you have any advice about and/or a way to allow standard users to add fonts?

re: How to allow users to manage file and print shares without granting other advanced privileges

kevin — Wed, 07 Sep 2005 02:33:34 GMT

Hi Aaron,

Currently our users need admin rights when they install a Palm like device. The need is to sync up with Outlook etc.
Do you have any suggestions for this?
thanks.

Palm...

Chamach — Thu, 29 Sep 2005 11:33:59 GMT

Palm and admin :
http://kb.palm.com/SRVS/CGI-BIN/WEBCGI.EXE/,/?St=38,E=0000000000160050878,K=7811,Sxi=17,Case=obj(1465)

re: How to allow users to manage file and print shares without granting other advanced privileges

Glenn Woodruff — Tue, 04 Oct 2005 18:27:02 GMT

It's nice that this can be done from TweakUI, but this doesn't help a lot in a managed or (in my case) XPe enviroment. Is there another way to do this?

re: How to allow users to manage file and print shares without granting other advanced privileges

Chris — Thu, 27 Oct 2005 17:33:16 GMT

Nice work!
I'm wonder if there is any way that I can alow my users to install local printer without belong to a Power User group? Thanks

Function permissions without granting other advanced privileges

John — Thu, 01 Dec 2005 21:09:08 GMT

I'm a sys admin with a question about desktop permissions. We are in a Win2K (migrating to XP) mid-size environment. We have customers who occasionally request admin rights to run certain software titles, etc. Sometimes we can grant limited file or registry permissions to allow them to function without elevated rights, sometimes not.

The current dilemma before me is a group of users who need to run regsvr32 to register new dll's on a fairly regular basis. Do you know of an explicit permission that would allow this, without elevating rights to power user or admin? Thanks

re: How to allow users to manage file and print shares without granting other advanced privileges

Aaron Margosis — Wed, 14 Dec 2005 06:50:20 GMT

John, take a look at this utility. It takes advantage of the fact that Windows 2000 introduced per-user registration data - HKCR is now a merged view of HKLM\Software\Classes and HKCU\Software\Classes (the latter is user-writable).

RegSvrEx - An Enchanced COM Server Registration Utility
http://www.codeproject.com/w2k/regsvrex.asp

re: How to allow users to manage file and print shares without granting other advanced privileges

Ryan — Thu, 22 Dec 2005 23:03:49 GMT

I'm stuck in a Windows 2000 environment and can't use that version of tweakui. Is there another easy way of doing this?

re: How to allow users to manage file and print shares without granting other advanced privileges

Aaron Margosis — Fri, 23 Dec 2005 04:22:06 GMT

Ryan, TEST THIS FIRST, but you may be able to build the ACLs you want on a Windows XP computer, then export those values from the registry and import them to the Windows 2000 computer. The three values you care about are: SrvsvcConnection, SrvsvcShareFileInfo, and SrvsvcSharePrintInfo.

re: How to allow users to manage file and print shares without granting other advanced privileges

Davoud — Wed, 28 Dec 2005 13:25:52 GMT

Hi,

I would like to know why changes to the “Manage file and printer sharing” operation are not needed and not recommended? And is there anyway to invoke these security windows such as “Manage file/print server connections” security window and so forth, directly and without using Tweakui?

Thanks

re: How to allow users to manage file and print shares without granting other advanced privileges

Steve — Thu, 02 Feb 2006 01:47:27 GMT

How do you support the remote LUA user whose machine for example has been exploited via a unpatched vulnerability such as blaster/sasser? The normal course of action would be to download a scan/repair utility, and install then run the utility. In the remote LUA scenario the installation/execution is prohibited. That has left us looking at a local administrator account as our "sky is falling" backdoor to deal with firmwide consequences of such an attack. Is there an alternative to having this backdoor in place.

Thx in advance,
Steve

re: How to allow users to manage file and print shares without granting other advanced privileges

Aaron Margosis — Thu, 02 Feb 2006 09:26:23 GMT

Steve: do you have any remote access (e.g., Remote Desktop, Remote Assistance) to the affected computer? Can you use RunAs to run the Malicious Software Removal Tool? BTW, once the MSRT has been run once as admin (and the EULA accepted), if you've enabled Automatic Updates MSRT will run automatically every month.
http://support.microsoft.com/Default.aspx?kbid=890830

re: How to allow users to manage file and print shares without granting other advanced privileges

Taylor — Mon, 18 Sep 2006 11:01:55 GMT

Hi,Mr Margosis
I've changed the setting by using tweakUI,but it didn't work even if I reboot my computer.what's happened?

re: How to allow users to manage file and print shares without granting other advanced privileges

Kaari — Sat, 23 Sep 2006 20:06:45 GMT

Hi,
I've got the same problem as Taylor. I set "Manage file shares" to FULL CONTROL for the local group INTERACTIVE, but no account in the local group USER can read, change or create file shares.
OS: Windows XP SP2 incl. all patches

Review the instructions on this post carefully -- there are three different items you need to change the access control for.

-- Aaron

re: How to allow users to manage file and print shares without granting other advanced privileges

Tom — Fri, 29 Sep 2006 02:03:23 GMT

Hi,
Is there any other ways to allow normal users to manage shares in addition to TweakUI?

TweakUI offers the only UI that I know of to edit the permissions. Without that you're manipulating binary values in the registry. Now, once you have established permissions on one system with TweakUI, you can export the relevant registry values (SrvsvcConnection, SrvsvcShareFileInfo, and SrvsvcSharePrintInfo) from that system and import them onto other systems. If you do this, make sure that the accounts being granted access are either domain accounts or built-in accounts like "INTERACTIVE" and not local accounts that won't exist on the other systems.

HTH

-- Aaron

re: How to allow users to manage file and print shares without granting other advanced privileges

Reniel — Tue, 03 Oct 2006 09:20:18 GMT

Hi,

Is there a way to incorporate "RUNAS.EXE" in logon scripts to run a program as an administrator without user intervention such as the password?

I am using rundll32 in logon scripts to install printers on the remote machine. In order for the ordinary user to install printers, I used gpedit.msc to allow "Power Users" to "load and unload device drivers". However, I am having problems setting the printer settings (i.e. page setup, paper size, etc.).

I have saved the settings of the printer in a network drive using the command:

rundll32 printui.dll,PrintUIEntry /Ss /n <name of printer> /a <file where to save the settings>

and then, tried to restore the settings using the following:

rundll32 printui.dll,PrintUIEntry /Sr /n <name of printer> /a <file where to save the settings>

However, it is telling me that the "Operation is not permitted" if I logon as a Power User. But if I use an account with Administrator rights, there is no problem.

I hope to solve this using the "RUNAS.EXE" utility.

Thanks!

RUNAS.EXE always requires the password to be entered at the console.

-- Aaron

Create shared folder using command line on xp (rundll32)

Jay — Tue, 23 Jan 2007 01:58:37 GMT

Hi,

Does anyone know a way to invoke a command to create and shared a folder in window XP? I am not sure if the rundll32 will do all the trick.

Thanks,

Jay

jaydiep@gmail.com

Jay:

Did you try NET SHARE from a command prompt?

HTH

-- Aaron

re: How to allow users to manage file and print shares without granting other advanced privileges

Pat Stafford — Tue, 24 Apr 2007 20:46:13 GMT

When I try to install TweakUIPowerToySetup.exe, I get an error: "Entry Point Not Found - The procedure entry point GetDllDirectoryW could not be located in the dynamic link library KERNEL32.DLL"

Is this supposed to be installable on Win2K? I tried the earlier version of TweakUI, but it doesn't offer any of the screens for privileges described above.

Pat: Each version of TweakUI is tightly coupled to the version of Windows for which it was made. The XP version will not be usable on Windows 2000; and unfortunately, the Windows 2000 version did not include the extra ACL editing capability that the XP version allowed. There may be ways to get through this if you don't mind some risky registry editing...

-- Aaron

re: How to allow users to manage file and print shares without granting other advanced privileges

Shrutika — Fri, 03 Aug 2007 09:17:23 GMT

Hi,

My machine is windows XP home edition, SP6.

I cannot get option "Manage file/print server connections” operation in the “Access Control” dropdown in the right pane.

I get 2 options namely "connect to registry remotely" and "access performance counter" on the tweakUI screen.

Could you help?

Thanks,

Shrutika

XP SP2 How to Install Local Printers without granting Power User or Administrator?

Jon88 — Thu, 03 Apr 2008 16:55:53 GMT

Does anyone know of away to How to Install Local Printers as a restricted user without granting Power User or Administrator in XP SP2? Thanks in advance.

What changes does the manage file shares do?

Aen — Tue, 16 Sep 2008 01:07:14 GMT

I do not want to install tweak UI on every server, instead i rather just make the changes that tweak ui would do, and manually set them on my servers. I have a script where i have users create shares with for new hires. they need rights to create shares on the servers across the US, but i dont want them to have rights to do anything else but create a share on those few servers.

re: How to allow users to manage file and print shares without granting other advanced privileges

Haas — Mon, 24 Nov 2008 23:38:46 GMT

Hi Aaron,

I was very happy when I found your solution for this problem.

But it must be that I'm doing something wrong I implemented the three changes that you explain using tweakui, but I can still ot add any printers.

When I use the Add Printer Wizard (or Print Managemtn) the 'Local Printer attached to this computer' is grayed out.

When I add my user to the power users it works.

Can you help me out please?

Regards,

John

[Aaron Margosis] This blog post is about file and printer sharing, not about installing printers. Installing local printers remains an admin task for the time being.

re: How to allow users to manage file and print shares without granting other advanced privileges

Haas — Tue, 25 Nov 2008 14:36:44 GMT

Aaron, Thanks for the reply.

For the time being is an interesting quote to take away. The task of adding drivers, ports and printers and sharing them is trivial and gets executed by helpdesk people or even key-users in a site.

Now we need to give them at least power user membership to enable them to do this task. This creates a risk.

Is it possible to figure out what individual rights I need to give a user to be able to give him the same possibilties?

This would mean usinf tools like process monitor en process explorer and the like.

Any quick pointers? Thanks, John

re: How to allow users to manage file and print shares without granting other advanced privileges

Thomas — Wed, 24 Jun 2009 15:51:49 GMT

Hi Aaron

I've configured the three registry values SrvsvcConnection, SrvsvcShareFileInfo and SrvsvcSharePrintInfo, using the tweakUI tool. The idea is to add a local built-in group (print operators?) or a domain group. Adding those using the UI is easy enough, and the settings are verified as saved.

However, creating new printer objects, the configured group does not even appear on the new object. The system have of course been booted.

Currently we use a script to change permissions on new printer objects, but changing the default permissions would be a much better solution.

Thank you.