I have a handful Win2k machines that are not part of a
network but are in a classroom environment. I've setup a
student account on each machine as regular users and of
course I'm using the administrator accounts. I need to
lock down the students' accounts so they can't screw up
anything but when I try to to run >gpedit.msc< within
their accounts I get, "You do not have permission to
perform this operation" and I get the Group Policy window
with the red Xs over the faces icon. I want to lockdown
the desktop, delete 'run', make the control panel
inaccessible, things of that nature.

Now the way I understand it is, if I want changes to only
take place in a 'users' account, I have to be logged in
that particular account. So if I'm not able to run it
from within the individual accounts, is there another
way of getting this done or is there a way to tweak
something so that I WOULD be able to run gpedit.msc from
within the 'users' accounts?

Could someone point me in the right direction with
please, I've been fooling around with this mess for the
past 4 days and have gotten absolutely NoWheRe.

THANX N ADVANCE. The Rookie/Wayne B.

Usually you can use "runas" to run a program while logged on as a regular user but I
think what you describe is that you are a victim of your own lockdown. On a local
computer, Group Policy will apply to all users including administrator unless some
hacks are used. Are you able to run gpedit.msc from your administrator account??
Usually what I do is manage the Group Policy from another network machine logged onto
an account/password that has admin rights on the target machine and then use mmc
Group Policy snapin - other computer to manage the Group Policy remotely if it has to
be locked down. If you find yourself locked out the link below may help. -- Steve

http://support.microsoft.com/default...d=kb;it;263166

"Wayne B." <(E-Mail Removed)> wrote in message
news:107b501c43f7e$645863c0$(E-Mail Removed)...
>
> I have a handful Win2k machines that are not part of a
> network but are in a classroom environment. I've setup a
> student account on each machine as regular users and of
> course I'm using the administrator accounts. I need to
> lock down the students' accounts so they can't screw up
> anything but when I try to to run >gpedit.msc< within
> their accounts I get, "You do not have permission to
> perform this operation" and I get the Group Policy window
> with the red Xs over the faces icon. I want to lockdown
> the desktop, delete 'run', make the control panel
> inaccessible, things of that nature.
>
> Now the way I understand it is, if I want changes to only
> take place in a 'users' account, I have to be logged in
> that particular account. So if I'm not able to run it
> from within the individual accounts, is there another
> way of getting this done or is there a way to tweak
> something so that I WOULD be able to run gpedit.msc from
> within the 'users' accounts?
>
> Could someone point me in the right direction with
> please, I've been fooling around with this mess for the
> past 4 days and have gotten absolutely NoWheRe.
>
> THANX N ADVANCE. The Rookie/Wayne B.
>
>

OK. After rereading and some thought, your problem is that you can't run
gpedit.msc while logged on as a regular user and you don't have to. Just run it
from your administrator account and keep in mind like I said that the Group
Policy will apply to all users unless you try the hacks listed below. You can
run commands while logged on as a regular user via the runas command. For
instance to bring up the mmc console from the command line use " runas
/user:administrator mmc " and you will then be prompted for password. --- Steve


http://www.jsiinc.com/sube/tip2400/rh2492.htm
http://support.microsoft.com/default...EN-US;Q293655&


"Steven L Umbach" <(E-Mail Removed)> wrote in message
news:9zzrc.93354$iF6.8207793@attbi_s02...
> Usually you can use "runas" to run a program while logged on as a regular user
but I
> think what you describe is that you are a victim of your own lockdown. On a
local
> computer, Group Policy will apply to all users including administrator unless
some
> hacks are used. Are you able to run gpedit.msc from your administrator
account??
> Usually what I do is manage the Group Policy from another network machine
logged onto
> an account/password that has admin rights on the target machine and then use
mmc
> Group Policy snapin - other computer to manage the Group Policy remotely if it
has to
> be locked down. If you find yourself locked out the link below may help. --
Steve
>
> http://support.microsoft.com/default...d=kb;it;263166
>
> "Wayne B." <(E-Mail Removed)> wrote in message
> news:107b501c43f7e$645863c0$(E-Mail Removed)...
> >
> > I have a handful Win2k machines that are not part of a
> > network but are in a classroom environment. I've setup a
> > student account on each machine as regular users and of
> > course I'm using the administrator accounts. I need to
> > lock down the students' accounts so they can't screw up
> > anything but when I try to to run >gpedit.msc< within
> > their accounts I get, "You do not have permission to
> > perform this operation" and I get the Group Policy window
> > with the red Xs over the faces icon. I want to lockdown
> > the desktop, delete 'run', make the control panel
> > inaccessible, things of that nature.
> >
> > Now the way I understand it is, if I want changes to only
> > take place in a 'users' account, I have to be logged in
> > that particular account. So if I'm not able to run it
> > from within the individual accounts, is there another
> > way of getting this done or is there a way to tweak
> > something so that I WOULD be able to run gpedit.msc from
> > within the 'users' accounts?
> >
> > Could someone point me in the right direction with
> > please, I've been fooling around with this mess for the
> > past 4 days and have gotten absolutely NoWheRe.
> >
> > THANX N ADVANCE. The Rookie/Wayne B.
> >
> >
>
>