Because Windows® security has changed over time it is important that every user logon have the security "privileges" to enable them to administer their own workstation (or terminal server logon). For Windows 95 through ME this is not a problem because those rights were granted to every user by default. For Windows 2000 a user needed to be a "power user" to have these rights and for XP, or later, versions only a workstation (or higher level) administrator had these rights by default.
The required security privileges for an Export-It user include:
Full control of the "Data Access Corporation" and "Syscob" keys in the HKEY_LOCAL_MACHINE [all users] hive of the Registry. For the initial installation, or for a “Rego & Icon” registration, the user logon under which execution occurs will also need the right to create these keys.
Full control of the "Local Machine Certificate Store" (a protected part of the Registry) where the Digital Certificates required by the Australian Customs Service are stored. This is only needed by a user executing Secure EDI [SEDI] programs at a site which interchanges EDI directly with Customs ICS, but it may be difficult to grant under Windows® Vista “home” editions (including Ultimate).
The simplest way to ensure sufficient privileges using built-in security groups is to make every Export-It user a member of the workstation (not network, domain, enterprise or other) "Administrators" group.
A "custom" security group, such as one named "Syscob Users," could also be created, assigned the requisite privileges and all Export-It users made a member of that custom group. This is the normal technique for sites employing Active Directory security.
Windows® Vista users normally prefer that User Access Control [UAC] be disabled. This is not a requirement, but the frequent UAC dialogs quickly result in the user becoming inured to them and answering to permit any action without consideration (defeating the purpose of UAC).
All users also require "Full" control of the HKEY_CURRENT_USER [user] hive of the Registry, but this is inherent in the rights of all users except for "Guest" and certain other limited accounts.
