restrict local users to...

[sergey akifiev]

how can i restrict local users to, for example, modify
display properties, install/remove software, use
floppies/cdroms?
there is couple standalone machines (i.e. w/o any network
connections), running win2k.
thnx in advance.

 

[Steven L Umbach]

First give them the minimum rights by keeping them as regular users which will
prevent them from installing most but not all software. Modify ntfs permissions on
the root/drive folder so that they have only read/list/execute permissions. For the
rest you can look into using Group Policy via gpedit.msc on the local computer which
will however restrict ALL users including administrators though an administrator
could still access Group Policy remotely via a network computer as long as he has the
user right to access from the network. User configuration is where you will find most
of the restrictions you want. If you do not want them to change the desktop, give
them only read/list/execute ntfs permissions to the desktop folder in their user
profile. I would suggest that the cases have locking tops and that the computer can
only boot from the hard drive and that you password protect cmos settings. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;q307882 -- same for W2K