Login security

[Richard]

How difficult is it to set up user permissions with
Windows 2000? What I want to do is only allow downloads
for two members of my family, and restrict the other two
from downloading anything from the internet?

I haven't purchased W2K yet, but will if I can do this
fairly easily. Thanks.

 

[Andrew Mitchell]

How difficult is it to set up user permissions with
Windows 2000? What I want to do is only allow downloads
for two members of my family, and restrict the other two
from downloading anything from the internet?

I assume you are talking about file downloads (executables etc) and not just
general web surfing??
If so it's fairly simple. Full instructions are available at
http://www.microsoft.com/windows/ie/using/howto/security/setup.asp

While you're playing around with the security settings you probably want to
disable downloading of ActiveX controls for those users too.

As these settings are specific to a user, you will need to login as the users
you want to lock down, and make the setting changes as them.

Note that there is nothing stopping them from changing the settings back
again unless you apply a local policy to stop access to the IE control panel.
If you want more information on how to do this, let me know.

Andy.

 

[Richard]

-----Original Message-----


I assume you are talking about file downloads (executables etc) and not just
general web surfing??
If so it's fairly simple. Full instructions are available at
etup.asp

While you're playing around with the security settings you probably want to
disable downloading of ActiveX controls for those users too.

As these settings are specific to a user, you will need to login as the users
you want to lock down, and make the setting changes as them.

Note that there is nothing stopping them from changing the settings back
again unless you apply a local policy to stop access to the IE control panel.
If you want more information on how to do this, let me know.

Andy.
.
Thanks for your response, Andy - yes, you are right - I

want to control .exe downloading, and please do let me
know about a policy to stop access in the Control Panel.

Richard

 

[Andrew Mitchell]

want to control .exe downloading, and please do let me
know about a policy to stop access in the Control Panel.

No worries, Richard. That's pretty easy too, but you have to be careful
because by default the following procedure will lock out *all* accounts from
the control panel (including the administrator), not just specific users.

Please read the following article carefully before following the below
instructions.
http://support.microsoft.com/default.aspx?scid=kb;EN-US;293655
Although the example they give relates to hiding My Network Places, the
information is relevant to any local policy you create.

Once you've read that article, just do the following:

Click Start, Run then type GPEDIT.MSC and click OK. You should have the Group
Policy editor open now.
Browse to User Configuration/Administrative Templates/Windows
Components/Internet Explorer/Internet Control Panel
In the right pane, you should see a setting titled "Disable the security
page". Double click this entry and enable the setting.

You have now applied the setting to all users. If you open Internet Explorer,
then click Tools, Options there will no longer be a tab labeled "Security"
where there was before.

Now just follow steps 6 through 14 of the article I mentioned above to make
sure that it's not applied to the administrator account. The only difference
being that in step 10, instead of reversing the My Network Places change, you
will be reversing the "Disable Security Page" setting.
(This doesn't have to be the "Administrator" account. It can be your usual
account as long as that account has admin permissions)


Andy.

 

[rightler]

Hello again -

I have recently been told that in order for all these user
controls to work - allowing .exe downloads with W2K, that
you must also be running on a server that is running W2K.
Does that sound right? Obviously my home computer is not
on a network. Thanks.

Richard

 

[Andrew Mitchell]

Hello again -

I have recently been told that in order for all these user
controls to work - allowing .exe downloads with W2K, that
you must also be running on a server that is running W2K.
Does that sound right?

Not quite. For the setting to be applied by what is called a "Group Policy"
the policy is created on a server and the computer must connect to that
server (or another domain controller on the same domain) for the settings to
take effect.

The procedure I described creates what is known as a local policy, which
requires no server or network.

Obviously my home computer is not
on a network.

That's fine. Just follow the steps I outlined earlier and it will work on a
standalone PC running Windows 2000 or XP.


Andy.