Hi,

I am running Win2k Professional on a standalone, non-networked machine.
It is to be deployed to users whom I don't want messing with my system!
What I would like to do is have an administrator account, with full
privileges (which I can manage to setup!) and a user account that is
severely restricted. In particular, I don't want them to have access to
the system folders or control panel, or be able to change any settings
-- just run programs (even restrict them to just a few applications,
but that might be asking too much), load/save/print documents and
shutdown the machine!

How do you do this!?

I have read-up on group policies and user profiles and I can't seem to
make the necessary changes to a particular user/group. The best I can
manage, so far, is adding the GPO snap-in to the MMC; but I haven't
messed any further because it implies that it affects the entire
machine, not one particular policy/profile.
Can you even do what I'm asking in Win2k Pro? It would seem an obvious
function of a multi-user OS; but I would have thought it would be at
least somewhat intuitive to set-up...

Many thanks;
Christopher Harrison

Outside of a domain, local policy has effect on all machine
local accounts equally. This is changing with the Vista release
(finally, after 6 years of being advised that this is needed)
You may find interest in (the painful to implement hack)
http://support.microsoft.com/default...b;EN-US;293655

"Christopher Harrison" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Hi,
>
> I am running Win2k Professional on a standalone, non-networked machine.
> It is to be deployed to users whom I don't want messing with my system!
> What I would like to do is have an administrator account, with full
> privileges (which I can manage to setup!) and a user account that is
> severely restricted. In particular, I don't want them to have access to
> the system folders or control panel, or be able to change any settings
> -- just run programs (even restrict them to just a few applications,
> but that might be asking too much), load/save/print documents and
> shutdown the machine!
>
> How do you do this!?
>
> I have read-up on group policies and user profiles and I can't seem to
> make the necessary changes to a particular user/group. The best I can
> manage, so far, is adding the GPO snap-in to the MMC; but I haven't
> messed any further because it implies that it affects the entire
> machine, not one particular policy/profile.
> Can you even do what I'm asking in Win2k Pro? It would seem an obvious
> function of a multi-user OS; but I would have thought it would be at
> least somewhat intuitive to set-up...
>
> Many thanks;
> Christopher Harrison
>

Gosh -- that's a hack-and-a-half... but it works! Thanks


Roger Abell [MVP] wrote:
> Outside of a domain, local policy has effect on all machine
> local accounts equally. This is changing with the Vista release
> (finally, after 6 years of being advised that this is needed)
> You may find interest in (the painful to implement hack)
> http://support.microsoft.com/default...b;EN-US;293655

"Christopher Harrison" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Gosh -- that's a hack-and-a-half... but it works! Thanks
>

Yes indeed, and you're welcome.

Be careful in planning as the hack's real pain comes when you
decide you need to change policy settigs, again, and again . . .

(PS - one can also deny full to Administrators on the directory
system32\GroupPolicy, but this is quite drastic and requires an
unset to edit with certainty of remembering to re-deny).

Roger

>
> Roger Abell [MVP] wrote:
>> Outside of a domain, local policy has effect on all machine
>> local accounts equally. This is changing with the Vista release
>> (finally, after 6 years of being advised that this is needed)
>> You may find interest in (the painful to implement hack)
>> http://support.microsoft.com/default...b;EN-US;293655
>