need access to user (not administrator) settings with runas

[David Curwin]

We have a Windows 2003 domain with Windows XP workstations.

We have a group policy in place that restricts users from accessing
the Internet Properties page.
We are now adding some new settings to the GPO that will change
various settings in Internet Properties.

I would like to be able to check to see that the changes have gone
through, and to see what settings are in place in the users computers.

My problem is that when I use right-click and shift Internet Options
in the control panel and choose Run As, and enter the user name and
password of an administrator, I get the Internet Properties of the
administrator. This is obviously not helpful as I'm looking for the
user's settings.

I have tried using the runas command from the command line, but
neither the /env or /noprofile switches prevent me from still getting
the administrator's settings.

Even if i run regedit (which is also blocked for users) using the
administrators credentials I get the registry entries under Current
User for the administrator.

As we are just beginning to implement Group Policy restrictions, I can
see this being a problem with many settings that are user specific.

Does anyone know a way to allow access to restricted applications and
control panel applets, while still showing the settings of the logged
in user?

 

[IBTerry [MSFT]]

Why not create a test user and logon to that account and verify that the
settings are correct?
You could place it in the same OU, groups etc as your standard users and
this would show you what settings are effective.
In addition the group policy management console will allow you to do "what
if" type analysis of policy and show you what would be effective for
certain users.
http://www.microsoft.com/windowsserver2003/gpmc/default.mspx

IBTerry [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Doug Knox MS-MVP]

See www.dougknox.com, Win XP Tips, Advanced Registry Editing for information
on how to look into another user's NTUSER.DAT file, without having to log on
to their account.