Security – How to remove the users from local admin rights with a GPO

As you're probably aware, when clicking on the file it is downloaded to the local machine and opened from the file system. Depending on how the document is opened from the browser and the client OS used, there are a few places that the file could be copied to and the user will need write access to these places.

If they simply open the file and don't check it out to their local drafts folder, it will be copied to:

• C:\Users\_username_\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO (Windows Vista)
• C:\Documents and Settings\_username_\Local Settings\Temporary Internet Files\Content.MSO (Windows XP)

If they check out the file and choose the 'Use Local Drafts Folder' option, it will be copied to:

• C:\Users\_username_\Documents\SharePoint Drafts (Windows Vista)
• C:\Documents and Settings\_username_\My Documents\SharePoint Drafts (Windows XP)

Can you check that as the end user you are able to create files in these locations? You may need to drop to the command prompt for Temporary Internet Files and enter a command such as:

type Test>test.tmp

By the way, the OpenDocumentsReadWriteWhileBrowsing registry key should have no effect on a SharePoint site, according to KB 870853. Behaviour 'by design'.

The only Microsoft-supported way to "copy" the user and group information would be to promote the source server to an Active Directory Domain Controller (DC) and join the "destination" server to that domain. If you wanted to completely remove the "source" server you'd need to promote another machine (potentially the "destination" machine) to being a DC before you demoted and removed the "source" machine. If you don't want or need to have an Active Directory infrastructure to deal with then this is probably sub-optimal.

The script I wrote for another answer could be used to create copies of the users and groups on a destination server computer. Passwords can't be migrated and the destination users and groups will have different Security Identifiers (SIDs) than the source. To migrate permissions you could use Helge Klein's wonderful SetACL tool to backup the NTFS ACL information on the source server and restore it on the destination server (after doing a search-and-replace on the backup file for the old server name to the new server name).