Move the take Ownership right from the Local Administrators, via User Rights in GPO...
That will fix the taking Ownership of the resource issue. Z Edward Ziots Network Engineer Lifespan Organization MCSE,MCSA,MCP+I, ME, CCA, Security +, Network + ezi...@lifespan.org Phone:401-639-3505 -----Original Message----- From: Terry Dickson [mailto:te...@treasurer.state.ks.us] Sent: Monday, April 27, 2009 3:19 PM To: NT System Admin Issues Subject: RE: Prevent mods to HKLM\Software\Microsoft\CurrentVersion\Run I understood that also, however if they are a local admin it might not matter. They could simply logon take ownership and they again have the rights to do what they want. -----Original Message----- From: David Lum [mailto:david....@nwea.org] Sent: Monday, April 27, 2009 2:07 PM To: NT System Admin Issues Subject: RE: Prevent mods to HKLM\Software\Microsoft\CurrentVersion\Run Bingo. -----Original Message----- From: Don Guyer [mailto:don.gu...@prufoxroach.com] Sent: Monday, April 27, 2009 11:35 AM To: NT System Admin Issues Subject: RE: Prevent mods to HKLM\Software\Microsoft\CurrentVersion\Run I think the OP meant he was looking for suggestions other than "don't put them in the local administrators group". :) Don Guyer Systems Engineer - Information Services Prudential, Fox & Roach/Trident Group 431 W. Lancaster Avenue Devon, PA 19333 Direct: (610) 993-3299 Fax: (610) 650-5306 don.gu...@prufoxroach.com -----Original Message----- From: Terry Dickson [mailto:te...@treasurer.state.ks.us] Sent: Monday, April 27, 2009 2:25 PM To: NT System Admin Issues Subject: RE: Prevent mods to HKLM\Software\Microsoft\CurrentVersion\Run Even if you did do that, as a local admin they could just take ownership of the folder and boom they are writing to the registry key again and the startup folder again. -----Original Message----- From: David Lum [mailto:david....@nwea.org] Sent: Monday, April 27, 2009 1:15 PM To: NT System Admin Issues Subject: Prevent mods to HKLM\Software\Microsoft\CurrentVersion\Run Is there a GPO way to prevent something from modifying this registry key? If I could prevent that and stuff from auto-populating the \Startup folder for "all users" I would be a happy camper. Tools like Spybot can do it, but that's not enterprise grade (read, centrally manageable). McAfee has a product that can do it - and we even have it and are licensed for it, but it's interface is so atrocious I'd probably nuke half my systems just attempting it. I'm looking for something other than "not local admin". David Lum // SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
