Admining Win 2OOO Users

[McBain_PDA]

we had some problems at work recently when someone decided to delete a lot of important files from the PC we use for rotas and things.

Tomorrow I'm going to install 2000 Pro onto it so that I can try and tighten the security. Can I set up 8 different uses so they can only access their own files,and no-one elses?

I expect I'll figure it out tomorrow but I thought I'd check here for pointers. :)

Btw, its a sole pc with no network and no internet connection. Also, its only a P3 1ghz which is why I'm only putting 2000 on it and not XP.

[[OLSC]Fizban]

Yep, if the drive is formated NTFS. Simplist way is give each user a direcctory for their crap (or each user will have a My Documents directrory use that) and do a properties on the directory and security tab and set who can see what, leave allow propogate permisons on so it inherits to the files and Bobs your aunts SO. If it's a Fat file systems give each of them a floppy disk :lol:

Oh and CONVERT volume /FS:NTFS [/V] to turn a drive from FAT to NTFS

Fizban
The cause of the problem is:
improperly oriented keyboard

[[OLSC]Zrutu]

Short Answer = Yes

Local user profiles are stored in C:\documents and settings (by default)
and the only people that have access to these folders are (by default)
Administrators (MACHINE\Administrators group)
The User
SYSTEM

This is where your "My documents" folder resides so other users on you box won't be able to see your files (if you store them in there)

You might have problems though if you need to make anyone a local admin (to use a CD writer for example.. I believe you have to give them this to burn disks) as they could potentially view other peoples files.

Although in general on Windows boxes assigning permissions isn't a tricky job

[[OLSC]Zrutu]

in my opinion:
On Win NT based OS's (NT, 2000, XP) in general all drives should be ntfs drives..
The only way i would have a Fat partition is if I had to share that partition with another OS in a dual boot system

[Sc00by]

Yeah as above, a nice set of NTFS Permissions will do the job for you NP. Just set a folder for each user where they have full control and everyone else has no access. You probably want to give an 'admin' user access to each folder for backups too...

:idea: Maybe you could hire Wint to do it for you? :thumbs:

[McBain]

Thinking about it, I think I've done similar things when setting share properties on a network.

For
CONVERT volume /FS:NTFS [/V]
Do I need to specify a drive in there anywhere, or it will do the drive I'm on? (I'm assuming you have to do this from dos?)

[[OLSC]Fizban]

Just replace volume with c: d: etc and it will convert next time you reboot. Or you can format as NTFS...

Fizban
The cause of the problem is:
transient bus protocol violation

[McBain]

Ahh, I see thanks. I can put it into a command prompt and then reboot? Any idea how long say a 10gig drive would take?

I presume I could also just make an NTFS partition on the Fat32 drive and set the 'My Documents' onto this drive.

** EDIT **

Does it matter if I convert the drive before or after I upgrade to 2000 Pro?

[Sc00by]

Do it afterwards as unless it's currently running NT4* you can't convert it to NTFS (Win95, 98 and ME don't support NTFS partitions)

It doesn't take many minutes from memory

And yes it's pretty much the same as setting up share permissions, except that you'll have a couple more options...

*in which case why upgrade? NT4 will do what you need it to do...

[[OLSC]Papa Smurf]

Ahh, I see thanks. I can put it into a command prompt and then reboot? Any idea how long say a 10gig drive would take?

I presume I could also just make an NTFS partition on the Fat32 drive and set the 'My Documents' onto this drive.

** EDIT **

Does it matter if I convert the drive before or after I upgrade to 2000 Pro?

when you tell it to convert (best to drop to a cmd prompt from within W2K) it will automatically schedule it for the next reboot, 10GB shouldn't take too long - 30 mins or so i reckon (make sure there is some free space on it though - 10% should be plenty)

it can't be a fat32 drive - it must be a drive with a fat32 partition on, in which case you can either add an NTFS partition (if there's any HD left unused) or convert to NTFS (my preferred option)

best to convert after the upgrade (IMHO best to do a fresh install rather than an upgrade...)

PS I am at work at 7am having been here all night - quite tired now

[McBain]

All went funky. As I started the 2000 install it asked if I wanted to convert to NTFS.

Once installed, I made the users and it automatically gives them access only to there own 'My Documents' and not the others :thumbs:

Only problem being 2000 didn't have Canon BJC 1000 drivers...but Canon BJC 4000 drivers seem to do the trick ;)

[McBain]

One thing I forgot that isn't quite right, all the icons for everyone's documents are the standard 'un-assigned' type icon, instead of an excel or word icon. Double clicking the file still opens the right program, but is there anyway I can make it show the correct icon again?

[Sc00by]

It's in 'file types' in explorer properties I think.

[wintermute]

Yep, though it may be quicker just to re-install office...

Rob

[McBain]

That's sorted. Next problem is Word opens files in read only for all the limited users :? Excel has no problem though...

[Sc00by]

You need to give the relevant users the 'write' permission.

[[OLSC]Fizban]

Shoot in the dark, they arn't using the same personal template directory are they?

Fizban
The cause of the problem is:
Too many interrupts

[wintermute]

I think they'll need the modify permission, write will only let them create new files not edit old ones.

Rob

[Sc00by]

I think they'll need the modify permission, write will only let them create new files not edit old ones.

That depends on whether the permission is set at the folder or file level...

Write on a folder allows you to create new files, write on a file allows you to modify it - Though I notice that M$ have changed the permissions slightly from NT to 2K/XP/2003, so I reserve the right to be horribly wrong...

[wintermute]

Standard permissions on Win2K (on a file):

Full control
Modify
Read & Execute
Read
Write

Each has two flags, one for allow, one for deny.

Rob

[McBain]

All the log-ins are membes of the group 'users'. I basically went to each of their 'My Documents' folders as the admin and highlighted all their files, added 'users' to the security if it wasn't there and gave full control to that group. Sorted :thumbs:

[wintermute]

Doesn't that mean they can now delete each others files though? I thought you were trying to prevent that?

Rob

[[OLSC]Fizban]

I don't think they have permison to the containing folder, but do to the files in the folder so it should be Ok

Fizban
The cause of the problem is:
waste water tank overflowed onto computer