How can I allow a Limited User to change TCP/IP settings, while strictly maintaining the principle of least privilege?

Question

In Windows XP or Windows Server 2003:

I have a laptop configured with software for network-based vulnerability scanning of systems. The reason this is put on a laptop instead of a desktop or server, is to check systems that normally operate independently of a network, or are on remote isolated networks.

Since this laptop's primary purpose entails travel between networks, all users of the system will need access to change the TCP/IP configuration. Within our department, that's not an issue. We're all Administrators on this system for maintenance purposes anyway.

However, we plan on loaning this system out to other departments or organizations from time to time. Obviously, we do not want these other groups to have full privileges on the system if they don't need them. As far as I can tell, the only Administrator-like privilege they should need is to change the IP Address, Subnet Mask, Gateway, and DNS Servers.

How can this be done for Limited Users, without giving them any more privileges from the higher groups?

Solution

Would this do?

http://support.microsoft.com/kb/297938

Method 2: If the User Has a Local Account

1. In the MMC snap-in, open Computer Management located in the Administration Tools folder.
2. Expand the Local Users and Groups node, and then click Groups.
3. In the right pane, double-click Network Configuration Operators.
4. Click Add
5. Enter the user to be added, and then click OK.
6. Click OK to close the Network Configuration Operators Properties window.

Computer management can also be found under the Administrator tools menu

Comments

[Iszi]

That looks good to me. Thanks! One addendum: To access the Local Users and Groups console, I generally recommend [Start->Run, lusrmgr.msc]. I've found this is the quickest and most universally-applicable method of running that snap-in.