I have a .Net application that has the requirements:

Admin - full access
single user: only run specific .Net application(s)

I have got the application running with "Windows XP Explorer User
Interface" shell.
Now I am trying to lock down the single user without limiting
Administration Group.

Note: I will probably use Manual Reseal Technique - install embedded and
then manually install application.

KM helpfully mentioned that I can use either "Explorer based shell" with
group policies or a Custom Shell.

I am trying to see which one I should put my effort into.

I have created a simple customer shell - but I don't understand:
- how this shell can apply to only the single user and not admin.

Also, there is a great deal of documentation on group policies, but I am
looking for
something that specifically details how to lock down a specific user to a
single
.Net Applciation interface while allowing admin free access.

Thanks, Eric

Hi all,

I followed directions in: http://www.jsifaq.com/subl/tip5600/rh5619.htm
to get different behavior using local group policy using the technique:
running mmc
Add/Remove Snapin
Add Group Policy Object Editor
Save as <name>.msc
Then run mmc
open <name>.mmc
Make Changes in "Administrative Templates"
Save - then backup Registry.pol
The logon to non-admin user - then logon to admin and change back
the copy backed up Registry.pol back

So I can do the Group Policy "hello world" and have different behavior for
Administrator and other users. But this brings up other questions:

1) Is there any more specific information on how to limit the user to
ony that single .Net Applciation using Group Policies.
- Note: I can play around with the Group Policies, but wondering if there
was an
specific steps posted anywhere.

2) If I make these Group Policy changes after installing Windows XPE do I
use the
Manual Reseal Technique - to create images to distribute - along with
other applciations that I will install manually. I am just wondering about
the
packaging and deploying after manually adjusting the image.

Thanks, Eric





"ecoulson" wrote:

> I have a .Net application that has the requirements:
>
> Admin - full access
> single user: only run specific .Net application(s)
>
> I have got the application running with "Windows XP Explorer User
> Interface" shell.
> Now I am trying to lock down the single user without limiting
> Administration Group.
>
> Note: I will probably use Manual Reseal Technique - install embedded and
> then manually install application.
>
> KM helpfully mentioned that I can use either "Explorer based shell" with
> group policies or a Custom Shell.
>
> I am trying to see which one I should put my effort into.
>
> I have created a simple customer shell - but I don't understand:
> - how this shell can apply to only the single user and not admin.
>
> Also, there is a great deal of documentation on group policies, but I am
> looking for
> something that specifically details how to lock down a specific user to a
> single
> .Net Applciation interface while allowing admin free access.
>
> Thanks, Eric

Eric,

> I have created a simple customer shell - but I don't understand:
> - how this shell can apply to only the single user and not admin.

All you have to do is to set up [HKEY_Current_User\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell] keys for all the
users you want to have custom shells for. Note that HKCU branch.

More info in Sean's article:
http://msdn.microsoft.com/library/de...erentUsers.asp

--
=========
Regards,
KM