Controlling PPPoE by a non-admin

A MacBook with Tiger is connected to the Internet over a manual controlled (established) PPPoE connection. The contract with the provider is not a flat rate but counting minutes. So the user wants manually start/stop the PPPoE connection. For an admin user this works fine. But what is about a standard user? Normally he is not allowed to do networking things. Is it possible to give him just the rights "start/stop PPPoE"?
Thanks in advance
Frank

This seems to be not enough. What I did in Terminal (bash):
<pre>
cd ~/Library
mkdir PreferencePanes
cp -R /System/Library/PreferencePanes/Network.prefPane ~/Library/PreferencePanes
</pre>
The differences between admin and standard user are:
The admin user has 2 icons: The PPP icon and the WLAN icon.
The standard user has 1 icon: The WLAN icon. The ESSID menu entry has a submenu that contains items for starting and stopping the PPPoE connection. This could be sufficient, but unfortunately the connection is started on demand or by default and must be disconnected manually. It should be started only manually like in admin mode.

Similar Messages

Delegate Control on OU for Non-Admins

Hello. I have an OU for a remote office. There is a local IT person who is able to join computers to the domain and manage the OU. I created a security group and this person is in this group. I have given the delegate control permission to this group and
everything is working fine. The IT person can join computers to the domain and do other things in the OU. The issue is that a new IT person has joined the team in that remote office and he needs the same rights. I added him to the security group but for some
reason he cannot join computers to the domain. He gets an access denied error. What am I missing??
Asif Shah

Hello. I have an OU for a remote office. There is a local IT person who is able to join computers to the domain and manage the OU. I created a security group and this person is in this group. I have given the delegate control permission to this
group and everything is working fine. The IT person can join computers to the domain and do other things in the OU. The issue is that a new IT person has joined the team in that remote office and he needs the same rights. I added him to the security group
but for some reason he cannot join computers to the domain. He gets an access denied error. What am I missing?
In addition check the user membership in other groups. Maybe he has Deny access somewhere in the domain.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Non admin removing parental control

Re subject above, I have non admin users who claim and have removed the parental control of access time limits by entering key sequence at boot.
How can that be stopped?

I don't believe it.
What key sequence?
They would have to know an "admin" password to make any system changes.

SCCM 2012 Remote control with NON admin ID

When trying to remote a machine via SCCM 2012 remote control using a non admin ID it does not connect. Get the following in the CmRcService log file:
HandshakeWorker failed..
The logon attempt failed (Error: 8009030C; Source: Windows) CmRcService 2014-12-10 01:19:41 PM 2632 (0x0A48)
Security filter server: DoHandshake failed..
The logon attempt failed (Error: 8009030C; Source: Windows) CmRcService 2014-12-10 01:19:41 PM 2632 (0x0A48)
m_pSecFilter DoHandshake() failed. CmRcService 2014-12-10 01:19:41 PM 2632 (0x0A48)
DoHandshake failed on server side.
The logon attempt failed (Error: 8009030C; Source: Windows) CmRcService 2014-12-10 01:19:41 PM 2632 (0x0A48)
Failed to do Handshake in Server.
The logon attempt failed (Error: 8009030C; Source: Windows) CmRcService 2014-12-10 01:19:41 PM 2632 (0x0A48)
Failed to create security context.. Security Handshake failed.
The logon attempt failed (Error: 8009030C; Source: Windows) CmRcService 2014-12-10 01:19:41 PM 2632 (0x0A48)
Failed to validate Security requirement..
The logon attempt failed (Error: 8009030C; Source: Windows) CmRcService 2014-12-10 01:19:41 PM 2632 (0x0A48)
Failed to complete the RDP connection..
The logon attempt failed (Error: 8009030C; Source: Windows) CmRcService 2014-12-10 01:19:41 PM 2632 (0x0A48)

Hi,
Please check the similar thread below that is a Group Policy issue.
Quote:
our group policy is allowing only the local administrator to access the network , so the normal user will not able to access the machine even the sccm remote tools member
https://social.technet.microsoft.com/Forums/en-US/77c865c2-7602-4234-a4cd-52d54ab6d653/sccm-2012-remote-access-to-client?forum=configmanagerdeployment
Best Regards,
Joyce

Non admin user - changes not saved (Safari settings, system prefs, etc.)

iMac, 2 users, one is administrator and other is standard user. Recently, in the non-admin user account, it has become impossible to make any changes. For example, adding an application to the the Dock, after logging out and back in next time, the application is not in the Dock any more. Also, making changes to the prefs in Safari, changes are not saved.
I noticed this after installing FireFox v4. I installed it as admin whilst in the non-admin users account. However, I don't believe that the installation of FF has anything to do with the problem, it just highlighted it. I've checked the permissions for the various directories that hold prefs info such as user/libraries/application prefs/etc. etc. and also Safari prefs. Nothing I can see that has changed in system prefs.
Any ideas on what has caused the problem (kids are known to fiddle from within the non-admin account) and any ideas on how to fix it?
Thanks

Hi PPRuNe,
You could try making the standard user an Admin too. To do this, make sure you are logged in to the standard user, go to System Preferences > Accounts > Standard user (you may have to unlock the padlock) > Allow user to administer this computer
This will allow changes to be made without being prompted for a password all the time.
However, if you had Parental Controls on, they probably won't work on an admin account because as an admin you have complete control over a computer, so the computer thinks there is no point in having the controls turned on. And if the kids are known to "fiddle," just think carefully!
Hope this helps you.
Chris.

A Solution for Enabling Sandbox activation by non admin users for testing (OIM 11gr2 PS2)

I just wanted to post what i came up with as a solution the the problem of not being able to Test the effects of sandbox changes for non admin level users prior to their publication. We are constantly making changes to the UI through sandboxes, the problem is rolling a sandbox back isn't easy, and we cannot be sure of the effects they will have on non administrative users until they are published, since the out of the box sandbox link isn't available to non Sysadmin level users.
To allow these non admin user accounts to test the effects of sandbox changes in our development environment, I did the following (as always, follow at your own risk):
Create and activate a new sandbox.
Close all open tabs (including the Home and Sandbox tabs) and click the "Customize" link.
Click the view -> source drop down in the upper left.
After the source is visible, click the Accessibility or Sandbox link to find the area that you will add the new "UserSandboxTest" (call it whatever you want) link.
Add a new commandImageLink directly in the panelGroupLayout: horizontal item before the "switcher" item (see the UserSandboxLink in my screen shot below):
Edit the Link you just inserted, Entering whatever you want the link to display as in your browser in the "Text" field.
Export the sandbox.
Unzip the exported sandbox and navigate to the IdmShellV2.jspx.xml (path should be: \templates\mdssys\cust\site\site).
Edit the IdmShellV2.jspx.xml file and find the new item you added in step 5.
Add the following to the commandImageLink xml item: actionListener="#{pageFlowScope.uiShell.context.launchSandboxes}" rendered="#{oimcontext.currentUser.roles['SANDBOX_USER'] != null}". Note: I used a new custom enterprise role, SANDBOX_USER, to control the display of the new link, You should substitute whatever EL conditions you need in the rendered property.
Save your IdmShellV2.jspx.xml file and zip the contents back up, just like you would for any other customization.
Import your newly edited sandbox back into the target environment.
Publish the sandbox.
This seems to work great for allowing us to test other sandbox changes effects on different types of users.

On step 10, adding the check to determine if the user should have access to the role ended up breaking access to the unauthenticated pages like the self registration page and the forgot userid/user login pages. Non-authenticated users cannot execute the method to return the role, so that fails which leaves the page not loading. To correct this I changed the rendered property to rendered="#{securityContext.authenticated}". This prevents the link from displaying on non authenticated pages, but displays for anyone else who's logged on. We only plan on using this in our development environment where no one but developers and system admins have access anyway, so it's not an issue that everyone will see the link. I wouldn't recommend putting this in an environment where end users will be logging in and testing without developing a method (or finding another way to limit the display) that can be called by unauthenticated users to prevent them from seeing the link.

Screen sharing to OS X Lion Server with non-admin account

I have set up a Lion Server with one admin (in addition to the root user) and several non-admin normal accounts. In Server.app, I have enabled remote login with ssh, and remote management via screen sharing. I am unable to use Screen Sharing to connect to the server from the non-admin accounts, but able to use the admin account. I've read that it is only enabled for admin users, but need to access from non-admin accounts, and I can't add these accounts to the admin group. Is there a way to do this with Workgroup Manager? I tried changing the Remote Management settings in System Preferences by adding the non-admin, but when selecting 'Observe' and 'Control' in the options for the user, they are not saved.

I resolved this issue by deselecting the "Enable screen sharing and remote management" in Server.app and going to System Preferences, Sharing Preferences, Screen Sharing, and allowing access for "All Users". If you have some users you want to allow VNC, you can create a group, add the allowed users to the group, and add the group under "Only these users".

Non-admin user can not logon to web pages

I setup an iMac, I am the administrator and I set up a non-admin user. I also setup parental controls to their default settings.
The user can log on to their account but when they go to a web page, any web page, that requires a logon, the authentication fails. I can login to the iMac as the administrator and can go to those same pages and try to logon and it works.
I tried disabling parenting controls but it still doesn't work. I don't think that I should have to change any settings to allow a non-admin user to log on to a website, but maybe there is something I am missing...
Any tips or things I should try?

It's recommended to have your Security mode on.
Anyways if you wish to, go to ''''Firefox'''' tab > ''''Options'''' > ''''Options'''' > '''''Security'''''
and do your custom settings.
Re-installing Mozilla Firefox may fix this problem.

X-Fi Mode Switcher won't work in XP non-admin accou

I have installed X-Fi extreme music on my WinXP SP2 machine. Both audio console and the graphical console launcher/mode-switcher won't work properly in non-admin accounts. It will be "stuck" in one mode and whatever I do, it refuses to change to another mode.
Both work fine when I use the admin account. Please help. Thanks in advance.

Unfortunatly Im a greedy cuss and won't share my computer with anyone so I'm running in more or less Admin 24/7 and not ran into the issue. I think there is a setting in XP that you can change that will allow non-admins to make changes to the system. You might check User settings for the account in the "User Accounts" in control panel. Will see if I can find some info on it for you but you can also check MS Knowledgebase.

Not able to install ActiveX (OCX) on Non-Admin user in Windows 7 ( internet Explorer 8/9)

I need the solution to install ActiveX controls throught CAB file (Micorsoft Cabinet) for non-admin users. Our solution is working for user accounts with adminstrator rights but not for nonadmin users.
So far we have tried solution given here: http://msdn.microsoft.com/en-us/library/dd433049(v=vs.85).aspx
and here:
http://blogs.msdn.com/b/askie/archive/2012/09/27/guidlines-on-implementing-activex-installer-service-axis.aspx
But we could not succeed. Pls Help !

Hi,
Apologize for the late reply and the misunderstanding about the ActiveX download location, we could change the location through the below registries:
Use Registry Editor to change the "ActiveXCache" value to the location you want in the following registry key:
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Use Registry Editor to change the "0" value to the location you want in the following registry key:
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ActiveX Cache
   NOTE: The values you enter in steps 1 and 2 must match.
More information, please check
How to Change the Download Location for ActiveX Files (registries exists in IE11).
Regarding the urls that download the cab files into user profile directory, would you mind to share the URL?
And here is some information regarding inf files:
About INF File Architecture
We may check the value of DestDir, DestDir can be set to 10 to place the file into the \Windows directory or to 11 to place the file into the \Windows\System directory. If no value is specified, the file is placed into the \Cache directory.
Best regards
Michael Shao
TechNet Community Support

Allowing Shockwave Player to run for non-admins

Hi all, I see the following problem on and off for years now, with Adobe Flash and in particular Adobe Shockwave Player.
I have a school that has a Windows 7 lab. Shockwave Player 11.6 is installed as part of the base image. It shows up in "Programs and Features"
After it was initially installed, I tested the plug-in by going to http://www.adobe.com/shockwave/welcome and it worked fine.
The problem I'm having is with non-admin users. Our students aren't local admins. Say they go to a website that has Shockwave content, for example, http://www.pbs.org/wgbh/aso/tryit/dna/index.html
When I (with a non-admin student account) click on the link to play the Shockwave content, a pop-up window appears. Then IE 9 displays a message "This webpage wants to run the following add-on: "Adobe Shockwave Player 11.6" from Adobe Systems Incorporated. Allow/Allow for all websites?" I don't want to see this again, so I click Allow for All websites. Then I get another window: "Adobe Shockwave Player is now installing....Installing compatibility components." So far, so good. The problem is, once the installation progress bar gets to the end, Windows User Access control pops up prompting for an admin user account and password to complete the install. Since they don't have an admin account, the install can't complete.
How do I get Shockwave Player to "just work" for non admin users? I see for Flash there is this document at http://forums.adobe.com/thread/987370 about registry permissions, etc. Is there a similar solution for Shockwave Player?
Please help, thanks,
Sir_Timbit

If SW is trying to install compatibility components, be sure to run the full installer before creating your base image

Non-admin Printer Setup?

At my work, none of the 350 users are admins. Before we can deploy Mac OS X 10.5.x, we have to allow them to add/delete their own printer. With Mac OS X 10.4.x, the Printer Setup Utility did not require an administrator name and password, so all was fine. But, I can't have 350 users submitting requests to me to add or delete printers for them 12 hours a day (there would have to me more than two more of me) from five time zones. Since there are remote users in 15 states and a total of 70 different offices, there's no way I can add all the printers someone might use ahead of time. How can I change Mac OS X 10.5.x to allow non-admin users to add printers?
-Doug

Follow up to my previous post.
After some further thought, there are permutations to the procedure I set out before. If you want to open it up for all users to add and administer printers, you can comment out the applicable Policy sections of cupsd.conf. Specifically, the following blocks commented out will allow a Standard user (or any user) to add and administer printers. This can be done through the web interface, command line 'lpadmin', or through *Add Printer* from a print window. With this configuration, no password will be required.
EDIT: No Parental Controls need be set with this method. The user could be Standard or Managed.
<pre style="overflow: auto;font-size:small; font-family: Monaco, 'Courier New', Courier, monospace; color: #222; background: #ddd; padding: .3em .8em .3em .8em; font-size: 9px;"># <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
# AuthType Default
# Require user @SYSTEM
# Order deny,allow
# </Limit>
# <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs>
# AuthType Default
# Require user @AUTHKEY(system.print.admin) @admin @lpadmin
# Order deny,allow
# </Limit></pre>
Obviously, there are policy and security implications with the above. You will have to decide if the new policies are within your overall security limits.
Note that I have left in place the earlier directive to allow only admin (sudoers) to change the cupsd.conf file.
<pre style="overflow: auto;font-size:small; font-family: Monaco, 'Courier New', Courier, monospace; color: #222; background: #ddd; padding: .3em .8em .3em .8em; font-size: 9px;"><Location /admin/conf>
AuthType Default
Require user @SYSTEM
# Restrict access to the configuration files...
Order allow,deny
Allow localhost
</Location></pre>
Matt
Message was edited by: Matt Broughton

Can't run programs from non-admin account

I'm new to the Mac and rusty with -- but not new to -- UNIX. I'm working with an iMac running OS X 10.2. I have installed several programs in a non-admin account (called "boys"), but they will not run from that account. The "get info" screen tells me that the "boys" account is the owner of the program. Read/write permission is enabled. When I try to run the programs, I get this error message: "The operation could not be completed because you do not have enough access privileges." I have installed the same programs in an admin account, and the programs run just fine from that account. I'd like to get this working so that the boys in the "boys" account can actually use the system. I have "inherited" this system from prior users. Programs that were on the system when I got my hands on it do run -- for the most part -- from "boys."
iMac Mac OS X (10.2.x)
iMac Mac OS X (10.2.x)

Thanks for the reply, Ken. My various unsuccessful attempts to solve this problem led me to create a folder named "Programs." (I know, my PC roots are showing.) I did this for two reasons: 1) I hoped that this would give me more control over what was happening; and 2) I wanted to give the children with whom I am working an easy way to find the programs that I want them to use. When I use < cd /users/boys > and then do an ls- l, I see the Programs folder. An ls -l on that folder shows all the program I have loaded and indicates that the "x" permission is applied to owner, group and others. Moreover, I assumed (incorrectly, perhaps) that installing the programs using the "boys" non-admin account would make them the "owner" of the programs and that "x" permission would follow. Well, ls -l indicates that they are the owners and that they do have execute permission. I can only guess that the prior users of this system -- and nobody in this organization seems to know where they are -- did something that requires more than Advil to overcome.
J...
iMac Mac OS X (10.2.x)
iMac Mac OS X (10.2.x)

QuickTime fails to initialize for non-admin users (Error 63441)

I have installed iTunes 6.0.4 (including QuickTime 7.0.4) on my XP PC. iTunes and QuickTime work fine for the Admin users, but not for non-Admin accounts.
iTunes crashes with the generic Microsoft 'send error report' message; QuickTime gives "QuickTime failed to initialize. Error # 63441".
Any help / suggestions appreciated.

Eventually fixed it!
As mentioned in numerous other posts this came down to an issue with registry keys.
Updated the permissions for HKEYLOCALMACHINE\SOFTWARE\Apple Computer, Inc.\QuickTime to give 'Full Control' to 'Everyone'.
Initially had a lot of difficulty accessing the Apple Computer, Inc. branch - kept getting 'access denied'. This turned out to be because there was no owner set for the key. Once I had made myself owner I was able to make the other changes.

Allowing non-admin users partial admin privileges

Hi All
I manage a number of Macs on a large corporate (PC-centric) network. Organisation policy prohibits giving users admin privileges. However, I want users to be able to do some admin tasks like installing software, but not to have admin privileges per se. The Parental Controls option for non-admin accounts does not offer sufficient functionality.
All the Macs are stand alone (not managed accounts), and are accessible via Apple Remote desktop. Few of the Mac users are command line savvy, so any solution has to be invisible, or via a simple gui.
Thanks in advance
Dave Mitchelll

Most software does not need to be in the Applications folder to run. Non-admin users can install most drag-and-drop software right inside their home folders and run the apps from there.

Controlling PPPoE by a non-admin

Similar Messages

Maybe you are looking for