Hi Ron,
I overlooked that wrinkle. You are correct. With any local group policy,
the policy will be applied to all users who log on locally - including
local administrators. There is no way via a local policy to prevent this.
The only way I can see to work around this is via Domains and domain group
policies. For home-based systems not on a domain, this is not an option.
For computers on a domain, you could implement a domain group policy that
would always trump a local group policy. For example, create a domain group
policy that enables the Run command and apply it to ONLY the Domain
Administrators group.
Recall that the order of application of group policies is this:
Local-Site-Domain-OU-OU-OU. So any local policy could be trumpted by
another policy at the domain level. Under this scenarion, with a local
policy that disables run, all users including local administrator logons do
not see the Run Command, but then if a Domain Admin logs on, they would see
the run command.
Again, unfoutunately this is not a solution in home-small office
implementations where you wouldn't be in a domain.
=========
This posting is provided "AS IS" with no warranties, and confers no rights.
=========
Paul Hayes, MCSE
Microsoft PSS
(e-mail address removed)
--------------------
