[Resolved] Adding a component (permissions error)

[olamm2k]

Hi,

Our students need to use VB6 as part of their Computing A-Level course. At the moment, when a normal 'Domain User' tries to add a component in VB, it crashes with the error "The memory could not be written." I'll find out the actual address of the memory if anyone thinks it will help.

To overcome this, we've added them to the 'Domain Admins' group, which works - so it must be some kind of permissions thing. However, this is not a good solution for network security; there must be a better way to do it.

Any ideas?

[Hack]

VB6 is out on a network share rather than the students workstations?

If so, what are the permission settings on the network share?

Where are the physical components files located?

[olamm2k]

No, it's installed on each individual workstation. We just ghost from a main image each time we add a computer or it breaks or whatever. The user's documents area/home drive, however, is a network share. They have at least change permissions on this. Their Applications Data folder isn't mapped (in the policy) - might this cause any problems?

The components are in the usual %windir%\system32\

[Hack]

What happens if the student is not logged into the network and attempts to add a component?

[Hack]

I have to scoot to a meeting and it probably is going to last a while.

Here is my thought:

Given what you posted before, the student Ids don't have to be Domain Admins but probably have to be added to the Administrator group for the PC they are using.

I'm going to bookmark this thread and I'll check back in this evening.

[olamm2k]

They have to be logged on to the network - that's the only way they have access to the computers. We're using XP Pro on most computers, and they log on to our domain (the usual Ctrl+Alt+Del thing).

Making them local admins, rather than domain, would be a little better - although I'm not sure how to do it. I'll have a look when I get in to work tomorrow. Being students, though, they still like to mess around changing the time and so on because they'll still have access to all the local computer folders.

[Hack]

Your network administration department should be consulted about this. It would seem to me that a configuration that enables the students to complete the class and still maintain network integrity shouldn't be that difficult to design.

[olamm2k]

Well, our Systems Administrator has pretty much left it to me - his area of expertise lies more in the hardware side of networking.

Sticking them all in Domain Admins was a quick fix, but I don't want it to become permanent simply because it's too high a level of permission for network security. There has to be a fairly simple fix, as I'm sure many institutions manage to get away with running it for the normal Domain User.

[Hack]

Can you login on a student machine with a student Id?

If so, I'd suggest making that student Id an Admin of the machine, removing that Id from the Domain Admin list, log onto the machine as that student, and run some tests to see if this really does fix it.

[olamm2k]

Will do - I'll let you know how it goes tomorrow.

[dglienna]

Although it's not the best idea, perhaps you could share the

%windir%\system32\

folder on each machine? Maybe copy it, and replace it when they log in, so that it's always clean?

[olamm2k]

That's an idea.

Well, I've tried adding the user to Power Users on the local machine - which seems to work. They still have restricted access, so they can't actually open system32 in Explorer or anything, but they can add components.

Now, do you know how I can add them to Power Users for each machine on the domain without going round all 250 (not really a VB issue, but if anyone can help...)?

[Hack]

Now, do you know how I can add them to Power Users for each machine on the domain without going round all 250 (not really a VB issue, but if anyone can help...)?

You kind of said it yourself when you said "each machine".

Each PowerUsers group on each machine would have to be modified.

To make it a little easier, you can create a Network group, and add all of the necessary Ids to that group, and then just add that group to the PowerUsers on each machine, but you would still have to visit each machine.

Once that was done however, modifiy would be easy as you would only have to modify the contents of the group you added to each machine.

[olamm2k]

That's how I was planning to do it - I've got a group called (aptly enough) 'Computing' and they're all in that. I was just looking for a quick way round. I could stick it in one of our logon scripts, so it did it when I logged on to each machine, I suppose. That would save a little time.

[Hack]

That's how I was planning to do it - I've got a group called (aptly enough) 'Computing' and they're all in that. I was just looking for a quick way round. I could stick it in one of our logon scripts, so it did it when I logged on to each machine, I suppose. That would save a little time.

Right...it has been quite a while since I've done any network administration work. I forgot about using login scripts, and yes, that will save a little work.

[olamm2k]

Thanks for your help; I'll mark this as resolved.