Editing group policy on standalone WinXP

[Jo Evans]

I want to define a new group policy similar to Power
Users but with a few restrictions such as disabling
Control Panel. The Group Policy snap-in for MMC allows
me to edit policies for Local Computer (which affects all
users) but not to edit individual group policies.

The computers concerned are stand-alone (no AD).

 

[Doug Knox MS-MVP]

There is no provision in XP for applying policies to single users or groups.

http://support.microsoft.com/?id=293655
HOW TO: Apply Local Policies to all Users Except Administrators on Windows 2000 in a Workgroup Setting

You may also want to see www.dougknox.com, Win XP Utilities, Windows XP Security Console for a small utilty that will allow you to apply a good portion of the user specific Group Policies on a per-user basis.

 

[Simon Pleasants]

There is no provision in XP for applying policies to single users or groups.

This explains a lot. I have been battling away to apply different
group policies to different users in XP Pro. It is easy enough to
apply, just ignored by the operating system.

But why not? I don't understand why it does not work. All the
facilities are there to do it. Speaking as someone who looks after a
number of Win2k machines, XP seems very backwards in this respect.
Why would you build all those levels of control into the system, only
to prevent people from using them?

Any suggestions you might have would be appreciated.

 

[pjp]

Yea, I'm finding that all very lacking also. Comes as a complete surprise I
can't seem to specify anything on a specific individual basis. makes me
wonder why the hell they put it in and even more so wonder why we all
shouldn't object to having to pay for the ill conceived design as it seems
basically useless?

 

[Doug Knox MS-MVP]

Its primarily there for compatibility. In a domain environment, you can apply policies on a group/user level.

 

[Simon Pleasants]

Its primarily there for compatibility. In a domain environment,
you can apply policies on a group/user level.

Interesting - I have now the system working as I wanted, but not a
domain in sight. I have customised the group policy as I saw fit,
added the users to the groups as I saw fit and customised the security
on the various folders that I wanted to restrict access to.

It is working exactly as I had intended. It's not very pretty, it's
not very user friendly, but it is effective.