XP's "Restricted" Security Group....

Experiencing a problem with Outlook 97 on XP. It seems users (unless given at least Power User priviledges) cannot update the C:\Windows\MS Exchange Settings.FAV file. Assigning permissions to the file itself doesn't work, so we believe it is a registry key problem. Finding all the "MS Exchange Settings.FAV in the registry, I edited the permissions to allow Domain Users full access. However, the problem still exists. I have noticed, however, that the Restricted Group policy is applied to these settings as well, and I'm woondering if they are overriding the changes I've made?

Does anyone know how to find out who are members of the Restricted Group (as this is built in group and not one you can see) or how Restricted Groups work?

Thanks...

 

Solution found. According to Microsoft, older Applications will often fail (isn't it amazing that Outlook97 is now considered an "older application "?) if users aren't given the "Power Users" group security setting. This is because the "Users" group is set by default as a member of the "Restricted Users" group, which disallows users to update settings and make changes to the computer. Older applications didn't have the new security model that new applications certified for 2K/XP have, so their security model doesn't now work with XP (registry keys are often unavailable that need to be).

As to the "Restricted" Security Group, this is a default group and the Users Group is automatically a member. You can view and change this by doing the following:

1)Start, Run, type, mmc
2)In the new console that comes up, click console, add/remove snapin.
3)Click the Add button.
4)Search and find the Security Templates and add that. Click Close.
5)Browse the tree to the following key: C:\WinNT Security Templates\Setup Security\Restricted Groups

You will see that Users is in this key as a Restricted Group. This is by Microsoft Design (see the following article: Description of Group Policy Restricted Groups. I had another one too, but I lost it. *sigh* Sorry about that....).

Anyway... so that's that. They need to be Power Users for Outlook97 to work...