Hiding Control Panel For All?

[Dave]

Hi all,
I'm trying to hide the control panel on several local stand alone XP
Pro PC's in the office. All the user accounts are set up as Power
Users. After a lot of reading, it looks like the best way to do this
is to use group policies. I set this up on my test system and it works
fine. My question is: this change affected all the groups, including
Administrators. Does this mean every time I log in as Administrator I
have to un-hide the control panel to make changes or can I limit hiding
the control panel to every one but the Administrator? Is there a
better way??

Thanks in advance...

Dave

 

[Steven L Umbach]

You might be able to exempt administrators by giving administrators deny
read permissions to the \windows\system32\group policy\user folder. But to
then manage Group Policy again you would need to give administrators read
permission again to that folder or manage GP remotely from another computer
on the network using the mmc snapin for Group Policy and selecting another
computer. Unless you are going to change GP a lot that may be a decent
solution. Also be sure to look at the free Microsoft Shared Computer Toolkit
at the link below. Note that hiding Control Panel will not stop the savvy
user from searching for the .cpl file and accessing it that way. You could
also implement Software Restriction Policies if you really want to lock the
computer down and the as the Shared Computer Toolkit does in a limited way.
By default local administrators are exempt from Software Restriction
Policies. --- Steve

http://www.microsoft.com/windowsxp/sharedaccess/overview.mspx --- Shared
Computer Tookit which required SP2.
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx
--- XP Software Restrcition Policies.

 

[Nepatsfan]

In (e-mail address removed) Dave
wrote:

Hi all,
I'm trying to hide the control panel on several local stand
alone XP Pro PC's in the office. All the user accounts are
set up as Power Users. After a lot of reading, it looks
like the best way to do this is to use group policies. I
set this up on my test system and it works fine. My
question is: this change affected all the groups, including
Administrators. Does this mean every time I log in as
Administrator I have to un-hide the control panel to make
changes or can I limit hiding the control panel to every one
but the Administrator? Is there a better way??

Thanks in advance...

Dave

You might want to take a look at these articles:

Lockdown by group using Local Computer Policy without Active
Directory
http://tinyurl.com/687jj

Local Computer Policy in a Workgroup
http://www.theeldergeek.com/gp07.htm

How to apply local policies to all users except administrators
in a workgroup setting in Windows 2000 (Applies to XP)
http://support.microsoft.com/default.aspx?scid=kb;en-us;293655

Windows XP Security Console
Courtesy of Doug Knox MS-MVP
http://www.dougknox.com/xp/utils/xp_securityconsole.htm

Just a suggestion, if you use the procedure that denies the
read permission to the Administrator, place a shortcut on the
Administrator's desktop to the C:\Windows\System32\GroupPolicy
folder. You might also want to create a shortcut directly to
gpedit.msc.

Good luck

Nepatsfan

 

[Guest]

The registry item

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (DWORD)

will do what you want , though it also blocks printers and network components.

It's also easily bypassed by typing 'control' from a cmd prompt.

 

[Dave]

Hi Steve,
Sorry about the slow response. I haven't worked on this issue since I
posted my question.
First, Thank you for your response! You have given me some things to
look at for sure. I am not a network administrator and don't know that
much about the Software Restriction Policies, just enough to be
dangerous. I will look at the links you sent and are sure I will have
more questions to post.
Again... Thanks!

Dave C.