Group Policy - User vs. Computer

Hi,

I am looking at the group policy edition in Windows XP Pro
(gpedit.msc). I am confused as to the difference between
the computer configuration section and the user
configuration section. I think I understand the computer
configuration section - if I enable or disable an option,
it applies to all users that log on to the computer.

The user configuration I don't understand. I would have
thought that this would allow me to enable or disable an
option for some users but not for others, but all a see are
the enable/disable/not configured radio buttons without
anywhere to enter which users/groups you want the setting
to apply to. For example, let's take the "Remove
Add/Remove Programs Programs" option. What if I wanted to
enable this option for my "Operators" group, but to disable
if for my "Supervisors" group? Is there a way to do this?

Thanks,
Paul

The Computer and User trees in policy are as you expect,
but that is only so for GPO (i.e. group policy applied from
Active Directory).
Local policy only supports all or none - every setting is
applied to all accounts.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Paul Kraemer" <KraemerPW@cs.com> wrote in message
news:8cda01c432b4$11b47e00$a301280a@phx.gbl...
> Hi,
>
> I am looking at the group policy edition in Windows XP Pro
> (gpedit.msc). I am confused as to the difference between
> the computer configuration section and the user
> configuration section. I think I understand the computer
> configuration section - if I enable or disable an option,
> it applies to all users that log on to the computer.
>
> The user configuration I don't understand. I would have
> thought that this would allow me to enable or disable an
> option for some users but not for others, but all a see are
> the enable/disable/not configured radio buttons without
> anywhere to enter which users/groups you want the setting
> to apply to. For example, let's take the "Remove
> Add/Remove Programs Programs" option. What if I wanted to
> enable this option for my "Operators" group, but to disable
> if for my "Supervisors" group? Is there a way to do this?
>
> Thanks,
> Paul