Security Questions

[Robert Paris]

I am looking for how I can do the following on Win2K:

1. Disable a User's ability to write to/edit the registry
(Actually disable for all but Administrator)

2. Disable user's ability to write files to all but one folder

3. Disable user's ability to execute any program except for a few that I
specify
(And can I log attempts to run/execute programs?)

4. In disabling cmd.exe, can I set up only two programs to run (on startup)
in command prompts (with RunAs service) - they're java programs - and still
keep all other java programs and the user from being able to do anything in
command prompt?

Answers to any of these questions would be greatly appreciated. Any pointers
to further resources would be great too! Thanks!

 

[Stanley Jones [MSFT]]

Try searching through the Group Policy Editor for options that suit your
needs. You may find a way to combine a few of your goals.