Group Policy...

[benzonoid]

I'm trying to restrict my home computer so that the users in my house
can only get to a few functions. I found that under MMC a snap-in
called group policy. under that in user configuration->administrative
templates i can disable lots of stuff... my problem is that when i
disable or enable these things they apply for all users... does anyone
know how i can apply these policies to only one user or group and not
to every user?

thanks

 

[Carey Frisch [MVP]]

You may find the following a better solution:

Microsoft Shared Computer Toolkit for Windows XP
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx

--
Carey Frisch
Microsoft MVP
Windows Shell/User

---------------------------------------------------------------------------------

:

| I'm trying to restrict my home computer so that the users in my house
| can only get to a few functions. I found that under MMC a snap-in
| called group policy. under that in user configuration->administrative
| templates i can disable lots of stuff... my problem is that when i
| disable or enable these things they apply for all users... does anyone
| know how i can apply these policies to only one user or group and not
| to every user?
|
| thanks

 

[bradly]

Sounds like all the user accounts are "administrators".

your best bet is to create a new user, and make it a limited account:

The limited account is intended for someone who should be prohibited
from changing most computer settings and deleting important files. A
user with a limited account:

• Generally cannot install software or hardware, but can access
programs that have already been installed on the computer.

• Can change his or her account picture and can also create, change,
or delete his or her password.

• Cannot change his or her account name or account type. A user with a
computer administrator account must make these kinds of changes.

• Can manage his or her network passwords, create a reset password
disk, and set up his or her account to use a .NET Passport.


Then password protect your "admin" accounts.

bradly

 

[benzonoid]

well i've created a limited user and an administrator account but under
the local computer policy->user configuration->administrative templates
it will allow me to remove mostly everything from desktop (including
startmenu access to hdd and basically lock down the system) but what
i'd like to do is only have these settings apply to a specific user and
not all users on the system. I know that this can be done on windows
server 2003 by adding a GPO to an OU but is it possible to do this on
an xp machine thats not connected to a DC?

 

[Nepatsfan]

(e-mail address removed),

I'm trying to restrict my home computer so that the users in
my house can only get to a few functions. I found that
under MMC a snap-in called group policy. under that in user
configuration->administrative templates i can disable lots
of stuff... my problem is that when i disable or enable
these things they apply for all users... does anyone know
how i can apply these policies to only one user or group and
not to every user?

thanks

Here's a program you might want to look into.

Courtesy of Doug Knox, MS-MVP
Windows XP Security Console
http://www.dougknox.com/xp/utils/xp_securityconsole.htm

If you're determined to use the Local Security Policy, here are
two methods to prevent the policy settings from being applied
to the Administrators group.

This method is probably the simplest to implement. You deny
Read permissions for the Administrators group to the
C:\Windows\System32\GroupPolicy folder.

Group Policy in a Workgroup setting.
http://www.theeldergeek.com/gp07.htm

Here's Microsoft's workaround. Applies to XP as well as 2K

How to apply local policies to all users except administrators
in a workgroup setting in Windows 2000
http://support.microsoft.com/default.aspx?scid=kb;en-us;293655

A word of warning! Make a few simple changes at first until you
become familiar with the procedure. Don't make all the changes
you want to implement at once. It is not that difficult to lock
yourself out of being able to reverse the settings. I've found
it's helpful to put a shortcut on the Desktop of an
administrator account to the folder I mentioned earlier as well
as to gpedit.msc.

Good luck

Nepatsfan