Allow or prevent the viewing and installing of a RIS image by a user or group
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
To allow or prevent the viewing and installing of a RIS image by a user or group
On the Remote Installation Services (RIS) server, open Windows Explorer.
Click the folder that contains the RIS folders and files. (The default name for the folder is RemoteInstall.)
Click the Setup folder.
Click the folder for the language of the installation image you want to confirm or change access to, and then click the Images folder.
Right-click the folder that contains the image that you want to confirm or change access to, and click Properties.
Click the Security tab.
For best security, if several names appear in Group or user names, and one of those groups is Everyone, click that group and then click Remove
Important
- The Group or user names box always includes SYSTEM. Do not remove this entry, and do not change the permissions on it. This entry is necessary for RIS.
Do one of the following:
In Group or user names, if you see the name of a group or user for whom you want to confirm or change access to a RIS image, click the name of the group or user.
In Group or user names, if you do not see the name of a group or user for whom you want to confirm or change access to a RIS image, click Add. Type the name of the group or user, click OK, and then click the name of the group or user.
Do one of the following:
To prevent the selected group or user from viewing and installing this image, click Remove.
To allow the selected group or user to view and install this image, under Allow, ensure that Read & Execute, List Folder Contents, and Read are selected.
When the list of group and user names and their permissions match the access you want to allow or prevent, click Advanced.
Select the check box marked Replace permission entries on all child objects with entries shown here that apply to child objects.
Notes
To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.
To open Windows Explorer, click Start, point to All programs, point to Accessories, and then click Windows Explorer.
This topic does not apply to Windows Server 2003, Web Edition.
Authenticated Users appears by default in Group or user names. This means that all authenticated users can view and install a RIS image. To allow a more limited group (instead of all authenticated users) to view and install a RIS image, add the appropriate group and allow the permissions described in this procedure. Then click Authenticated Users and click the Remove button.
With products in the Windows Server 2003 family, Authenticated Users does not, by default, contain anonymous users or guests. The Everyone group contains guests. As described in this procedure, it is recommended that you exclude Everyone from the list of groups for which permissions are assigned on the RIS image; then use Authenticated Users or a more restricted group for assigning these permissions. For more information about differences in default security settings for groups such as Authenticated Users (as compared to the settings in earlier operating systems), see Related Topics.
If you leave SYSTEM but remove all other names from Group or user names, no one will be able to perform remote installations with this image.
Using this procedure, you can control the user's ability to install a particular RIS image, as well as the user's ability to see the files in that image. You might want to exert less control, however. You can do this by changing permissions that, unless overridden by this procedure, affect the user's ability only to install (not see) a particular RIS image. For more information about this, see Related Topics. Once you have chosen a particular approach, it is recommended that you continue to use that approach whenever modifying permissions for images; this will help prevent confusion.
If you prevent a user from viewing or reading the files in an image, you also prevent the user from installing the image.
Information about functional differences
- Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. For more information, see Viewing Help on the Web.
See Also
Concepts
Add RIS Client Installation Images
Create a Remote Installation Preparation Wizard image
Choosing appropriate group memberships for RIS administrators
Allow or prevent the installing of a RIS image by a user or group
Differences in default security settings