user with non-admin rights can't initialize drive

[StuberB]

Hi,

Anyone know how to allow a user with 'Power User' rights to initialize an external hard drive.

Run-as local admin doesn't quite work. I also started the initialization process then gave the drive back to the user to finish formatting in NTFS. However, the HD is 2 tb and he only got to 10 mb before Win7 quits and shoots failed error.

Any advice is much appreciated.

Thanks,

Ben

 

[Tepid]

If you have the drive hooked up and you initialize it, what is stopping you from formatting it for them to begin with? It's of little use till it is formatted, a quick format takes less time than informing a user they need to format there newly initialized drive. Or am I missing something?

 

[StuberB]

I agree ... formatting the drive take little effort and would be simple enough for me to do. However, I need the user to be able to do it himself under the current permission settings I gave him. Reason being is the user is preparing/formatting several drives daily for use in our company.

 

[Tepid]

Well to the best of my knowledge a power user should not have any problem doing that.
Are you sure they are a power user?

Is this a domain environment?
You may have to give them local admin privileges to the local PC. And only Domain User privs on the Domain.

If you are locking down desktops,, then You may have to trust your tech to be able to use their system as an Admin. Techs should always have a certain level of Admin Privs.

 

[StuberB]

Excellent suggestion.

You are correct that this is a domain environment. I set the user locally with 'Power User' rights. You are also correct that if I give the user local admin rights he can accomplish this but local admin rights are not an option.

 

[Tepid]

Other than giving him an Run As Admin userID, you don't really have a choice if Power User doesn't give him rights.

Unless you give him admin rights to just the management console, not sure if that will work.

 

[StuberB]

Unfortunately, that doesn't work for initializing drive. It does work for some things like renaming drives. But, I need to be able to isolate/target his admin cred. to just initialing/formatting.

thx though

 

[Tepid]

Yeah,, don't think you can get that granular with that.
My rights management skills are not super excellent, but due to the nature of what you are asking, it may not be fully possible.

 

[HQuest]

If you can't set this on Local Policy Editor (gpedit.msc), then I'm afraid there is no much to do besides the all powerful full local Administrator rights.

 

[fseal]

Yeah, formatting a drive is a HUGE admin right. Probably one of the most serious. So from a philosophical standpoint, it's one of the last things you want to be able to grant a domain user.

Depeding on the person, generally people that need that kind of power are given local admin rights but standard domain user rights.

If it's just for fomratting drives you might think about using a laptop that is off your internal netowrk and give local admin rights to that, then restoring the HD image after he's done if you are really tight on security.

 

[kegobeer]

Is this user logging on to the machine as a local user, or is this user logging in to the domain and then trying to format a drive?

 

[Tepid]

They are a Domain User but he does not want them to have any kind of Admin Rights.

 

[kegobeer]

Create a local user with whatever rights are necessary, then log in to the local machine instead of the domain. That should work.

 

[fseal]

That's actually the same as giving the domain user local admin rights for a particular machine. Which would also work but it sounded like they didn't want anyone to have local admin rights on any machine.

But non-admin rights and the ability to randomy format a drive attached to a machine are just plain diametrically opposed ideas. SO... it's no surprise that it's not going easy.

 

[WindowsStar]

Suggestion: If this is part of the persons job (i.e. to format drives for other users in the company) why not setup an off domain computer (a computer not joined to the domain). Then setup a local account with Administrator Rights to format drives etc. Since the computer is NOT on the domain the user will not have any Admin Rights on the domain. If you are truly worried about security you could disable the NIC on the computer and NOT connect it to the network. (I know this can be easily defeated, but you can put a written policy in place that the computer is to be only used for this purpose and not to be connected to the network). Extremely simple solution.

 

[kegobeer]

Suggestion: If this is part of the persons job (i.e. to format drives for other users in the company) why not setup an off domain computer (a computer not joined to the domain). Then setup a local account with Administrator Rights to format drives etc. Since the computer is NOT on the domain the user will not have any Admin Rights on the domain. If you are truly worried about security you could disable the NIC on the computer and NOT connect it to the network. (I know this can be easily defeated, but you can put a written policy in place that the computer is to be only used for this purpose and not to be connected to the network). Extremely simple solution.

A perfect solution. Why didn't I think of that?

 

[WindowsStar]

Suggestion: If this is part of the persons job (i.e. to format drives for other users in the company) why not setup an off domain computer (a computer not joined to the domain). Then setup a local account with Administrator Rights to format drives etc. Since the computer is NOT on the domain the user will not have any Admin Rights on the domain. If you are truly worried about security you could disable the NIC on the computer and NOT connect it to the network. (I know this can be easily defeated, but you can put a written policy in place that the computer is to be only used for this purpose and not to be connected to the network). Extremely simple solution.

A perfect solution. Why didn't I think of that?

Thank you. That is why we are all here. Many times other people have posted simple solutions I never thought of. That is why I am here. Anything that makes my life smiple is a good thing!

 

[fseal]

?!?!? I suggested that 4-5 posts ago

 

[WindowsStar]

?!?!? I suggested that 4-5 posts ago

With Respect: I went back and read the posts and I don't see where you suggested using a non-domain machine off the domain and off the network.

Your suggestion was to give Local Admin rights on a Domain Machine that is completely different.

Please correct me if I am wrong.

 

[fseal]

...
If it's just for fomratting drives you might think about using a laptop that is off your internal netowrk and give local admin rights to that, then restoring the HD image after he's done if you are really tight on security.

Seperate machine, off the network, and obviously if itp's off the network it has to be a non domain account logging into it...