Best Practise to lock down server 2012 for Junior Admins

We require locking down the desktop for junior admins. Essentially we would like for them to only access specific tools and applications.
Below are examples of specific tools they would require access to however, if we want to block out everything else then what is the best way to go about that? I would image a combination of group rights? how best to handle this?
Examples
All Programs->Accessories->System Tools->System Information. then export report.
"ipconfig /all
go to Run and then type "systeminfo" and capture all data.

You can use security group and delegation of administration model.
http://technet.microsoft.com/en-us/library/cc755982(v=WS.10).aspx
Santhosh Sivarajan | Houston, TX | www.sivarajan.com
ITIL,MCITP,MCTS,MCSE (W2K3/W2K/NT4),MCSA(W2K3/W2K/MSG),Network+,CCNA
Windows Server 2012 Book - Migrating from 2008 to Windows Server 2012
Blogs: Blogs
Twitter: Twitter
LinkedIn: LinkedIn
Facebook: Facebook
Microsoft Virtual Academy:
Microsoft Virtual Academy
This posting is provided AS IS with no warranties, and confers no rights.

Similar Messages

What is the best way to lock down an iMac?

What is the best way to lock down an iMac to a desk?

Run a cable through the hole in the stand and lock it to the desk. There are lots of security products out there to do this, here is a good sample to look for:
imac security lock cable

Unable to install Sharepoint Foundation 2013 in Windows Server 2012 for FIM 2010 R2

HI,
I am Unable to install Sharepoint Foundation 2013 in Windows Server 2012 for FIM 2010 R2,
Before SharePoint Foundation 2013 installation I installed all prerequisite software that is required for SharePoint Foundation 2013 but when we run SharePoint Foundation 2013 setup that gives below error so I am requesting you please help on this.
Setup is unable to proceed due to the following error(s):
Windows Server Appfabric is not correctly configured.You should unistall Windows Server Appfabric and reinstall it using the SharePoint Products Preparation Tool.
Regards
Anil Kumar

You really need to do what error is suggesting.
Windows Server Appfabric is not correctly configured.You should unistall Windows Server Appfabric and reinstall it using the SharePoint Products Preparation Tool.
Nosh Mernacaj, Identity Management Specialist

Is Distributed Transaction Coordinator services of the application role are required by SQL Server 2012 for clustering and support of SharePoint 2013.

All I want to know is if Distributed Transaction Coordinator services of the application role are required by SQL Server 2012 for clustering and support of SharePoint 2013.
I have been planning and deploying my companies first Windows Server 2012/SQL Server 2012 Always On cluster and Always On Availability Groups Multi-Subnet cluster and instances for SharePoint 2013, and I will be brutally honest, the documentation on either
the MSDN and TechNet leave alot to be desired. Continually finding links in the documentation will take me from a Windows 2012 reference to a page talking about Windows Server 2008 or R2, The differences of which there are so many when it comes to configurations,
settings, roles, services when working with SQL Server 2012. I have been confused, frustrated, screaming mad, with all the misdirection in this documentation. The documentation takes me windows 2008 R2 which is different than 2012!
Tired and trying to pick myself up off the floor!
Greg
Gman

In general, DTC is not required for SQL 2012. But, since you are asking specifically about SharePoint, it would be better to ask in a SharePoint forum. They would be more likely to know those situations where FTC might be needed by SharePoint.
.:|:.:|:. tim

Buying SQL Server 2012 for a server

I'd like to buy SQL Server 2012 for a server running an Xeon E-1230 v3 (if it matters). Will these be adequate:
Microsoft SQL Server Standard Edition Single Software Assurance OPEN BUSINESS: 228-04560
5 CALs: 359-01028

Hello,
This is a community forum for technical questions & issues.
For question regarding pricing / licensing please contact a Microsoft sales partner or licensing expert.
Call (1-800-426-9400), Monday through Friday, 6:00 AM to 6:00 PM PST to speak directly to Microsoft licensing specialist.
http://www.microsoft.com/sqlserver/en/us/get-sql-server/how-to-buy.aspx
http://www.microsoft.com/sqlserver/en/us/get-sql-server/licensing.aspx
http://www.microsoft.com/licensing/about-licensing/sql2012.aspx
For selecting the right Edition of SQL Server depending on your requirements, please visit
Features Supported by the Editions of SQL Server 2012
Olaf Helper
[ Blog] [ Xing] [ MVP]

Migrating From Window Server 2003 to Window Server 2012 for Web server deployment and Developmemt Machine is on Window Server 2008

Hi Microsoft Team,
We need your urgent advice and that is also on priority:
Issue Description: We need to migrate from
WINDOW SERVER 2003 to WINDOW SERVER 2012 while the development activity will be carried
under WINDOW SERVER 2008 as DEVELOPMENT BOX.
.NET Framework Version: 3.5 ( For both DEVLOPMENT(WINDOW SERVER 2008) and WEBSERVER(to WINDOW SERVER 2012))
IIS Version: 7.5 (For both DEVLOPMENT(WINDOW SERVER 2008) and WEBSERVER(to WINDOW SERVER 2012))
Need your quick advice Is that configuration feasible for Development and
Deployment (Web Server).
Highly appreciate your response as this will depend which product we need to buy also if you feel any showstopper or concern. Please let us know.

Hi,
As suggested by Tim, in order to get better assistance, we can ask for help in the following IIS forum.
IIS Forum
http://forums.iis.net/
In addition, regarding migrating from Windows Server 2003 to Windows Server 2012, the following blog can be referred to for more information.
Step-By-Step: Active Directory Migration from Windows Server 2003 to Windows Server 2012
http://blogs.technet.com/b/canitpro/archive/2013/05/27/step-by-step-active-directory-migration-from-windows-server-2003-to-windows-server-2012.aspx
Best regards,
Frank Shen

What is the best practise to provide a text file for a Java class in a OSGi bundle in CQ?

This is probably a very basic question so please bear with me.
What is the best way to provide a .txt file to be read by a Java class in a OSGi bundle in CQ 5.5?
I have been able to read a file called "test.txt" that I put in a structure like this /src/resources/<any-sub-folder>/test.txt from my java class at /src/main/java/com/test/mytest/Test.java using the bundle's getResource and getEntry calls but I was not able to use the context.getDataFile. How is this getDataFile method call to be used?
And what if I want to read the file located in another bundle, is it possible? or can I add the file to some repository and then access it - but I am not clear how to do this.
And I would also like to know what is the best practise if I need to provide a large data set in a flat file to be read by a Java class in CQ5.
Please provide detailed steps or point me to a how to guide or other helpful resources as I am a novice.
Thank you in advance for your time and help.
VS

As you can read in the OSGi Core specification (section 4.5.2), the getDataFile() method is to read/write a file in the bundle's private persistent area. It cannot be used to read files contained in the bundle. The issue Sham mentions refers to a version of Felix which is not used in CQ.
The methods you mentioned (getResource and getEntry) are appropriate for reading files contained in a bundle.
Reading a file from the repository is done using the JCR API. You can see a blueprint for how to do this by looking at the readFile method in http://svn.apache.org/repos/asf/jackrabbit/tags/2.4.0/jackrabbit-jcr-commons/src/main/java /org/apache/jackrabbit/commons/JcrUtils.java. Unfortunately, this method is not currently usable as it was declared incorrectly (should be a static method, but is an instance method).
Regards,
Justin

Can we lock down the system for BW object and not bex objects

Hello,
I have a question about object changeability. We want to lock down the BW production system but leave it open for adhoc query. Can we lock down the BW system only for few objects like Cubes, ODS, Infoobjects, Infosets, Multiproviders, and keep the system open for Bex objects like Query, varaibles and also for Infopackges and DTP's.
Which tcode can we use for this ?
Thanks,
Message was edited by:
Kiran Mehendale

hi, usaully production system will be non changeable for all objects.. but as far as SAP BW is concerned we can make certain objects changeable by setting as follows..
in production go to RSA1 - Transport Connection, select Object changeability button from tool bar, here you will find a list of objects which can be made changeable in a closed system.. just click on required objects and set it to Everything Changeable..
Reg,
Pradhiba
<REMOVED>

Question on how to lock down an iPad for demonstration in my store.

I work for an Apple reseller and we have a few demo iPads. The are running the current apple supplied demo content but we have a problem. We have a guy who comes in here every day and downloads his own apps and sets all of the apps to Chinese. We can't use the built in restrictions because they are disabled on demo iPads.
I was wondering if there is a way to keep people from downloading their own apps and from changing app settings. We have to restore them about 3 times a week and it is getting to be a hassle. I tried google to no avail.
Thanks.
~Britton

Take a look at this link, http://stackoverflow.com/questions/5011774/lock-down-iphone-ipod-ipad-so-it-can- only-run-one-app

Creating a Custom Event Log View Shortcut on a server desktop for an admin

Good morning,
We have a new admin starting and I would like to create custom event log view shortcut on there desktop for each server they need to check. Is there a way to do this in Server 2012 and Server 2008?
I have figured out how to create a shortcut of the Application and System log, but not Custom Views. Thanks.

Hi,
Based on my research, you can create a custom view like
this.However, I tried miltiple ways to create a shortcut of the custom view of the event viewer and no result. I can only create a shortcut of the event viewer. You may need a script can achieve that.
Best regards,
Susie

Configure directiry server failover for delegated admin schema 2

Hello,
I am using Delegated Admin for Schema 2 on solaris 9 sparc platform.
I want to configure directory servers failover for delegated admin.
Unfortunately I havent found any clue for the same.
Can anyone help me?
Regards,
Shujaat Nazir
Senior System Engineer
Cyber Internet Services, Pakistan
http://www.cyber.net.pk

Different product.
Schema 1 used the old iPlanet Delegated Admin.
Schema 2 uses Delegated Admin, based on Identity Server.
As far as I know, failover is not in this product.

Best way to setup Windows Server R2 for a business - Should I virtualize it?

I am setting up a server for a small business. They are using it to run their software which access a SQL database, and they are using it for file sharing etc. They have about 7 users accessing the server. I wanted to set this up right
and since they purchased Windows 2012 R2 Server i know that it comes with 2 VM licenses. I was thinking about using hyper V to setup a virtual machine and in that virtual machine setup their server for their database program and file sharing.
The main reasons I was thinking about setting it up this way is for the future. If we want to put a new server with better hardware in the future, we could just transfer the Virtual machine over to the new machine without having to setup everything from
scratch. Also from the research I have been doing there may be an added benefit to virtualizing it for disaster recovery.
I am still learning, and wanted to ask the pros what they thought the best practice should be in setting up a server like this.
I was planning on installing the GUI version on the host just because I am not comfortable with powershell yet. I know the best practice is to install core and then setup your VM's that way, but perhaps I will change to that in the future.

In your case, virtualization is a good solution. It will leave you with easy options for future migration and disaster recovery. Using the GUI version is also a good idea. Not only is there no real reason to use a core server here, having the GUI also makes
it easier for them to log in and do small management tasks if that should be required.

Disable opportunistic locking on Server 2012 R2 - Is downgrading to SMBv1 really the only way?

We have an application that uses an Omnis 7 datafile (a service-less, Access-like database, from what I understand). The application vendor has told us that opportunistic locking must be turned off on the server hosting or the clients accessing the
datafile, or there is a greatly increased risk of corruption of the Omnis datafile.
We are migrating some applications from a 2003 server to a 2012 R2 server, including this datafile. I have read about opportunistic locking on 2012 R2. It seems opportunistic locking is hard-coded into both SMBv2 and SMBv3 and there is no way
to disable it without disabling SMBv2 or SMBv3. Is this true? Is there truly no other solution for this but to downgrade my server to use only SMBv1?

Hi Scott,
As you said we cannot disable Opportunistic locking in using SMB2 or SMB3.
See:
https://login.live.com/kb/296264/en-us
•The opportunistic locking registry keys are valid only for traditional SMB (SMB1). You cannot turn off opportunistic locking for SMB2.
From your description it is the limitation of the application - SMB2 comes with Windows Vista /Windows 2008, which means the vendor of the application did not recommend to use SMB2 or the application is released for earlier systems while SMB2 is not available
at that time.
You can confirm with the vendor to see if any upgrade version of that app which is suitable for newer operation systems.
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

How to lock down the ipad for employee use

I would like to know if they is any app or something that I can use to lock the ipad down for small business use.
The last thing I want is my employees checking their facebook on my ipads.

What's the need for a business plan thousands of people buyt touch pads and computers every day and don't know how to use them. More or less they end up being paper weights. Beside the restrictions are instented to stop misuse. And who said he didn't have a business plan. the ipads replace pen and paper and so employee enter information directly into the server. This lets the employee be mobile and still do their work. It's being done in places all around the world. Ipad is an computer for the most part.
U going to tell me he should not use computers next? Maybe he should enter track important information at all?
it's funny how one question of how do I restrict access on an ipad turns into an inquisition.
Name any major corporation that let's their employee do whatever they want on their computers? Name a College?
That's why these companies build in this security stuff any way. You are protecting your investment by taking the proper steps to make sure that the equiptment is not misused. Where do you work where your Boss let's you do whatever you want on his or her computer. Play games? Get viruses?
You seem to making some kind of special assumptions because it's a ipad.
Same this goes for printers, copying machines, and coffee machines. You never give people unlimited access to any thing unless you wan to call the service man 20 times a week.

Best method of Locking down computers (theft prevention)

Our lab was robbed last night of 6 G5s and 7 23" monitors. All computers were locked with cable locks but were obviously cut...very easily.
Does anyone have any better methods of locking computers down to make it very difficult to remove hardware? These cables broke like strings and our cameras have not been installed yet (they're going in tomorrow).
We're replacing the computers with all new Mac Pros and screens, any suggestions would help.
Thanks gang.

i just installed SMARTreporter and i was wondering how you configured it to send mail?
Are you saying the thieves are hooked up to the net and SMARTreporter is using their email account or yours? I mean did you check off
"use the preferences of Mail.app" or
"use the following SMTP setup" ?
I ask because i don't use my ISPs email service, but rather the free web-based services and i don't think SMARTreporter could use that.
John, when you say that your computers emailed you from a queens address, you mean internet address, yes?
Did the police say that this was going to be useful?
As far as the undercover software, seems pretty good, especially with their money back guarantee. Makes me want to install it on a used cheaper computer just to follow it with friends, like instead of watching a mystery movie. Especially with the camera phone-homes.
My only question is, how many computers are resold as is, and how many are 'prepared' for resale, maybe with a clean install of the system, so as to 'cover their tracks'.
The web site mentions that FBI statistics reveal that 97% of stolen computers are never recovered. We know that 70 to 85% of all crime is related to drugs. Now i would tend to think that those thefts done by addicts in need of cash for an immediate fix don't concern themselves with such questions, but those to whom they sell might. And we know that sometimes things are specifically 'ordered' by fences. That kind of preparation implies more organisation. Maybe more diligence to cover their tracks and knowledge about the systems in question.

Best Practise to lock down server 2012 for Junior Admins

Similar Messages

Maybe you are looking for