policy settings for stand-alone pc

[Guest]

I have a stand-alone (i.e. non-domain) pc running xp pro. There are multiple
user accounts most of which are set to "limited". But I want to make further
restrictions on what such accounts can see and/or do. The type of things that
a group policy would normally control if the pc was in a domain. Is there an
easy way to do this?

I looked at local policies but these appear to apply the same settings to
all users, even members of the admins group!

I tried to use a logon script to set the registry settings that a group
policy would normally set but that failed because a "limited" user can't
write to the registry!

I think I can do a "runas" in vb.net (maybe scripting too?) so maybe I could
call my .net application from my login script? But this seams alot of work!

 

[Malke]

I have a stand-alone (i.e. non-domain) pc running xp pro. There are
multiple user accounts most of which are set to "limited". But I want
to make further restrictions on what such accounts can see and/or do.
The type of things that a group policy would normally control if the
pc was in a domain. Is there an easy way to do this?

I looked at local policies but these appear to apply the same settings
to all users, even members of the admins group!

I tried to use a logon script to set the registry settings that a
group policy would normally set but that failed because a "limited"
user can't write to the registry!

I think I can do a "runas" in vb.net (maybe scripting too?) so maybe I
could call my .net application from my login script? But this seams
alot of work!

Make new *groups* that have the restrictions you want. Set the
restrictions with Group Policy Editor (Start>Run gpedit.msc [enter]).
Add the users who should belong to that group. Make sure you also add
yourself and the Administrator to the group.

Malke

 

[Guest]

....but surely this will end up with all users (including my account and the
administrator account) having the same group policy settings. I want members
of different groups to have different settings. Can this be done?

I have a stand-alone (i.e. non-domain) pc running xp pro. There are
multiple user accounts most of which are set to "limited". But I want
to make further restrictions on what such accounts can see and/or do.
The type of things that a group policy would normally control if the
pc was in a domain. Is there an easy way to do this?

I looked at local policies but these appear to apply the same settings
to all users, even members of the admins group!

I tried to use a logon script to set the registry settings that a
group policy would normally set but that failed because a "limited"
user can't write to the registry!

I think I can do a "runas" in vb.net (maybe scripting too?) so maybe I
could call my .net application from my login script? But this seams
alot of work!

Make new *groups* that have the restrictions you want. Set the
restrictions with Group Policy Editor (Start>Run gpedit.msc [enter]).
Add the users who should belong to that group. Make sure you also add
yourself and the Administrator to the group.

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

 

[Guest]

Richard,

Steve Riley has put this in another post, I think this will solve your
problem...
**************************************************
http://support.microsoft.com/default.aspx?scid=kb;en-us;293655

Steve Riley
(e-mail address removed)
**************************************************

...but surely this will end up with all users (including my account and the
administrator account) having the same group policy settings. I want members
of different groups to have different settings. Can this be done?

I have a stand-alone (i.e. non-domain) pc running xp pro. There are
multiple user accounts most of which are set to "limited". But I want
to make further restrictions on what such accounts can see and/or do.
The type of things that a group policy would normally control if the
pc was in a domain. Is there an easy way to do this?

I looked at local policies but these appear to apply the same settings
to all users, even members of the admins group!

I tried to use a logon script to set the registry settings that a
group policy would normally set but that failed because a "limited"
user can't write to the registry!

I think I can do a "runas" in vb.net (maybe scripting too?) so maybe I
could call my .net application from my login script? But this seams
alot of work!

Make new *groups* that have the restrictions you want. Set the
restrictions with Group Policy Editor (Start>Run gpedit.msc [enter]).
Add the users who should belong to that group. Make sure you also add
yourself and the Administrator to the group.

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

 

[Guest]

I've read the article. It looks to describe exactly what I'm trying to do.
Thanks for your help.

Richard,

Steve Riley has put this in another post, I think this will solve your
problem...
**************************************************
http://support.microsoft.com/default.aspx?scid=kb;en-us;293655

Steve Riley
(e-mail address removed)
**************************************************

...but surely this will end up with all users (including my account and the
administrator account) having the same group policy settings. I want members
of different groups to have different settings. Can this be done?

Richard wrote:

I have a stand-alone (i.e. non-domain) pc running xp pro. There are
multiple user accounts most of which are set to "limited". But I want
to make further restrictions on what such accounts can see and/or do.
The type of things that a group policy would normally control if the
pc was in a domain. Is there an easy way to do this?

I looked at local policies but these appear to apply the same settings
to all users, even members of the admins group!

I tried to use a logon script to set the registry settings that a
group policy would normally set but that failed because a "limited"
user can't write to the registry!

I think I can do a "runas" in vb.net (maybe scripting too?) so maybe I
could call my .net application from my login script? But this seams
alot of work!

Make new *groups* that have the restrictions you want. Set the
restrictions with Group Policy Editor (Start>Run gpedit.msc [enter]).
Add the users who should belong to that group. Make sure you also add
yourself and the Administrator to the group.

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"