>> Apparently yes.
>>
>> Apparently anybody who has the "load or unload a device driver" right 
>> can also start and stop system services. (WTF?) So all I need to do is 
>> create a suitable group and assign people to it and I'm done. Yay, me! 
>> :-D
> 
> If you are worried enough that they will log off other users (either 
> accidentally or maliciously), then why aren't you worried that they will 
> start unloading device drivers? ;-)

Well, if you do, you only mess your own stuff up. I'm not concerned 
about people messing their own stuff up, only other people's stuff! :-D

(Basically, we have a new guy in the lab who is... uh... overly keen to 
prove himself. Apparently it's been causing all sorts of problems. This 
guy recently discovered that he could kick people off other computers, 
and has been doing so extensively. [Not helped by the two morons in 
charge of IT accidentally giving everybody at the UK sight administrator 
access to every PC on the network - thanks, guys!] So I was told to 
"fix" this - which I did. The trouble now is that you can't restart the 
service for our flakey lab software, which you need to be able to do...)

Post a reply to this message