"please contact your system administrator"... I *am* the administrator

[Esta Vida Nueva]

I am trying to lock-down a PC running XP Pro for a friend, as their oldest
son is a little bit funny and keeps trying to lock the rest of the family
out (and once succeeded so it took forever trying to hack in).

I have now wiped the machine clear and built it from scratch, and am using
Group Policy via Start > run > "gpedit.msc" to enable security settings.

Some of the settings I have applied, such as disabling the DOS prompt are
applying to Administrator as well, so even when I am logged on as
Administrator, the system is not allowing access to the Console.

If anyone can direct me as to configuring this to allow Administrator to be
"above" the settings enacted I would appreciate this. I remember when using
Poledit on Windows95 you would create a policy for each user... this would
be helpful too if possible.

 

[Carey Frisch [MVP]]

HOW TO: Apply Local Policies to All Users Except Administrators
http://support.microsoft.com/default.aspx?scid=kb;en-us;325351&Product=winsvr2003

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

----------------------------------------------------------------------------------------

"Esta Vida Nueva" (e-mail address removed) wrote in message:

|I am trying to lock-down a PC running XP Pro for a friend, as their oldest
| son is a little bit funny and keeps trying to lock the rest of the family
| out (and once succeeded so it took forever trying to hack in).
|
| I have now wiped the machine clear and built it from scratch, and am using
| Group Policy via Start > run > "gpedit.msc" to enable security settings.
|
| Some of the settings I have applied, such as disabling the DOS prompt are
| applying to Administrator as well, so even when I am logged on as
| Administrator, the system is not allowing access to the Console.
|
| If anyone can direct me as to configuring this to allow Administrator to be
| "above" the settings enacted I would appreciate this. I remember when using
| Poledit on Windows95 you would create a policy for each user... this would
| be helpful too if possible.
|
|
| --
| Steve

 

[Esta Vida Nueva]

The MS way works, but is the most convoluted ridiculous way imaginable! Try this link, which works MUCH better, and is FAR easier!

http://is-it-true.org/nt/nt2000/atips/atips131.shtml

Hope this helps

This was is much better than the other, It didn't make sense how the MS way
could work, this way is much easier to understand and see.

Many thanks!

 

[Guest]

Glad it worked! Just don't forget to deny your account or group on that folder!! Just as important, don't forget the background refresh setting. The first time you forget will make you pull your hair out. The good thing about this is that when you need to make a change, undo the deny, make your changes, and then, the most important part, put deny back on. If you don't, you will become intimately acquainted with the CACLS application and command line mania.

 

[Esta Vida Nueva]

Glad it worked! Just don't forget to deny your account or group on that
folder!! Just as important, don't forget the background refresh setting.
The first time you forget will make you pull your hair out. The good
thing about this is that when you need to make a change, undo the deny,
make your changes, and then, the most important part, put deny back on.
If you don't, you will become intimately acquainted with the CACLS
application and command line mania.

Thank you for killing another bird with this stone! I had hoped there would
be another way to impliment specific file permissions; this will be very
useful on an XP home machine.

Thanks again!