Tag: User Configuration
Prohibit Enabling/Disabling components of a LAN connection
Determines whether administrators can enable and disable the components used by LAN connections. If you enable this setting (and enable the “Enable Network Connections settings for Administrators” setting) the check boxes for enabling and disabling components are disabled. As a result administrators cannot enable or disable the components that a connection uses. Important: If the “Enable Network Connections settings for Administrators” is disabled or not configured this setting will not apply to administrators on post-Windows 2000 computers. If you disable this setting or do not configure it the Properties dialog box for a connection includes a check box beside the name of each component that the connection uses. Selecting the check box enables the component and clearing the check box disables the component. Note: When the “Prohibit access to properties of a LAN connection” setting is enabled users are blocked from accessing the check boxes for enabling and disabling the components of a LAN connection. Note: Nonadministrators are already prohibited from enabling or disabling components for a LAN connection regardless of this setting.
Prohibit access to properties of components of a LAN connection
Determines whether Administrators and Network Configuration Operators can change the properties of components used by a LAN connection. This setting determines whether the Properties button for components of a LAN connection is enabled. If you enable this setting (and enable the “Enable Network Connections settings for Administrators” setting) the Properties button is disabled for Administrators. Network Configuration Operators are prohibited from accessing connection components regardless of the “Enable Network Connections settings for Administrators” setting. Important: If the “Enable Network Connections settings for Administrators” is disabled or not configured this setting does not apply to administrators on post-Windows 2000 computers. If you disable this setting or do not configure it the Properties button is enabled for administrators and Network Configuration Operators. The Local Area Connection Properties dialog box includes a list of the network components that the connection uses. To view or change the properties of a component click the name of the component and then click the Properties button beneath the component list. Note: Not all network components have configurable properties. For components that are not configurable the Properties button is always disabled. Note: When the “Prohibit access to properties of a LAN connection” setting is enabled users are blocked from accessing the Properties button for LAN connection components. Note: Network Configuration Operators only have permission to change TCP/IP properties. Properties for all other components are unavailable to these users. Note: Nonadministrators are already prohibited from accessing properties of components for a LAN connection regardless of this setting.
Turn off notifications when a connection has only limited or no connectivity
This policy setting allows you to manage whether notifications are shown to the user when a DHCP-configured connection is unable to retrieve an IP address from a DHCP server. This is often signified by the assignment of an automatic private IP address”(i. e. an IP address in the range 169. 254. *. *). This indicates that a DHCP server could not be reached or the DHCP server was reached but unable to respond to the request with a valid IP address. By default a notification is displayed providing the user with information on how the problem can be resolved. If you enable this policy setting this condition will not be reported as an error to the user. If you disable or do not configure this policy setting a DHCP-configured connection that has not been assigned an IP address will be reported via a notification providing the user with information as to how the problem can be resolved.
Prohibit TCP/IP advanced configuration
Determines whether users can configure advanced TCP/IP settings. If you enable this setting (and enable the “Enable Network Connections settings for Administrators” setting) the Advanced button on the Internet Protocol (TCP/IP) Properties dialog box is disabled for all users (including administrators). As a result users cannot open the Advanced TCP/IP Settings Properties page and modify IP settings such as DNS and WINS server information. Important: If the “Enable Network Connections settings for Administrators” is disabled or not configured this setting will not apply to administrators on post-Windows 2000 computers. If you disable this setting the Advanced button is enabled and all users can open the Advanced TCP/IP Setting dialog box. Note: This setting is superseded by settings that prohibit access to properties of connections or connection components. When these policies are set to deny access to the connection properties dialog box or Properties button for connection components users cannot gain access to the Advanced button for TCP/IP configuration. Note: Nonadministrators (excluding Network Configuration Operators) do not have permission to access TCP/IP advanced configuration for a LAN connection regardless of this setting. Tip: To open the Advanced TCP/IP Setting dialog box in the Network Connections folder right-click a connection icon and click Properties. For remote access connections click the Networking tab. In the “Components checked are used by this connection” box click Internet Protocol (TCP/IP) click the Properties button and then click the Advanced button. Note: Changing this setting from Enabled to Not Configured does not enable the Advanced button until the user logs off.
Prohibit access to the Advanced Settings item on the Advanced menu
Determines whether the Advanced Settings item on the Advanced menu in Network Connections is enabled for administrators. The Advanced Settings item lets users view and change bindings and view and change the order in which the computer accesses connections network providers and print providers. If you enable this setting (and enable the “Enable Network Connections settings for Administrators” setting) the Advanced Settings item is disabled for administrators. Important: If the “Enable Network Connections settings for Administrators” is disabled or not configured this setting will not apply to administrators on post-Windows 2000 computers. If you disable this setting or do not configure it the Advanced Settings item is enabled for administrators. Note: Nonadministrators are already prohibited from accessing the Advanced Settings dialog box regardless of this setting.
Prohibit adding and removing components for a LAN or remote access connection
Determines whether administrators can add and remove network components for a LAN or remote access connection. This setting has no effect on nonadministrators. If you enable this setting (and enable the “Enable Network Connections settings for Administrators” setting) the Install and Uninstall buttons for components of connections are disabled and administrators are not permitted to access network components in the Windows Components Wizard. Important: If the “Enable Network Connections settings for Administrators” is disabled or not configured this setting will not apply to administrators on post-Windows 2000 computers. If you disable this setting or do not configure it the Install and Uninstall buttons for components of connections in the Network Connections folder are enabled. Also administrators can gain access to network components in the Windows Components Wizard. The Install button opens the dialog boxes used to add network components. Clicking the Uninstall button removes the selected component in the components list (above the button). The Install and Uninstall buttons appear in the properties dialog box for connections. These buttons are on the General tab for LAN connections and on the Networking tab for remote access connections. Note: When the “Prohibit access to properties of a LAN connection” “Ability to change properties of an all user remote access connection” or “Prohibit changing properties of a private remote access connection” settings are set to deny access to the connection properties dialog box the Install and Uninstall buttons for connections are blocked. Note: Nonadministrators are already prohibited from adding and removing connection components regardless of this setting.
Specify the order in which Windows Installer searches for installation files
This policy setting specifies the order in which Windows Installer searches for installation files. If you disable or do not configure this policy setting by default the Windows Installer searches the network first then removable media (floppy drive CD-ROM or DVD) and finally the Internet (URL). If you enable this policy setting you can change the search order by specifying the letters representing each file source in the order that you want Windows Installer to search:– “n” represents the network;– “m” represents media;– “u” represents URL or the Internet. To exclude a file source omit or delete the letter representing that source type.
Prohibit rollback
This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation. If you enable this policy setting Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result Windows Installer cannot restore the computer to its original state if the installation does not complete. This policy setting is designed to reduce the amount of temporary disk space required to install programs. Also it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However because an incomplete installation can render the system or a program inoperable do not use this policy setting unless it is essential. This policy setting appears in the Computer Configuration and User Configuration folders. If the policy setting is enabled in either folder it is considered be enabled even if it is explicitly disabled in the other folder.
Prevent removable media source for any installation
This policy setting prevents users from installing any programs from removable media. If you enable this policy setting if a user tries to install a program from removable media such as CD-ROMs floppy disks and DVDs a message appears stating that the feature cannot be found. This policy setting applies even when the installation is running in the user’s security context. If you disable or do not configure this policy setting users can install from removable media when the installation is running in their own security context but only system administrators can use removable media when an installation is running with elevated system privileges such as installations offered on the desktop or in Add or Remove Programs. Also see the “Enable user to use media source while elevated” and “Hide the ‘Add a program from CD-ROM or floppy disk’ option” policy settings.
Always install with elevated privileges
This policy setting directs Windows Installer to use elevated permissions when it installs any program on the system. If you enable this policy setting privileges are extended to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop) assigned to the computer (installed automatically) or made available in Add or Remove Programs in Control Panel. This profile setting lets users install programs that require access to directories that the user might not have permission to view or change including directories on highly restricted computers. If you disable or do not configure this policy setting the system applies the current user’s permissions when it installs programs that a system administrator does not distribute or offer. Note: This policy setting appears both in the Computer Configuration and User Configuration folders. To make this policy setting effective you must enable it in both folders. Caution: Skilled users can take advantage of the permissions this policy setting grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this policy setting is not guaranteed to be secure.