Restricting specific user groups/accounts

[Guest]

I am trying to restrict a certain user account on my pc, like in the group
policy mmc snap-in under user settings, i want to restrict access to right
clicks, control panel etc etc but only for one account called "Internet
Access" How do I do this without all my accounts (ie Adminstrator) loosing
functionality? I want this account to only have access to the internet (ie)
and msn messenger + webcam. I want it to not be able to do ANYTHING else...
Very stuck here, help??

 

[Guest]

Is this a stand-alone PC? If so, you need Windows Vista to do this. If it is
a domain member you can define a Group Policy for that user which restricts
all these things.

 

[Steven L Umbach]

For a non domain computer the Shared Computer Toolkit may be your best bet
to try. It also is possible change NTFS permissions on the local Group
Policy so that the users/groups you do not want to have "user" configuration
applied to have deny read permissions but then the admin will not be able to
further edit local Group Policy until he has read permission again or tries
to edit local Group Policy remotely from another computer on the network.
You would need to modify permissions on the
windows\system23\grouppolicy\user folder. In XP Pro you need to disable
simple file sharing to be able to see the security tab of a folder/file in
it's properties. To limit what applications the user can run or folders he
can access you need to modify NTFS permissions so that the user has no
permissions for the folder /file and you can also use Software Restriction
Policies to restrict access to applications to non administrators.

Steve

http://www.microsoft.com/windowsxp/sharedaccess/default.mspx
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx

 

[cmcanulty]

I am trying to do this also but with a Windows Media Center 2005 PC.
The toolkit mentioned doesn't work with Media center, any help for me?

 

[Steven L Umbach]

You might want to post in the newsgroup for
Microsoft.public.windows.sharedaccess to see if it can work on Media Center
or not. If it can not then you would need to look at the other option of
hacking permissions for local Group Policy and using Software Restriction
Policies as I mentioned and possibly upgrading to Vista if that can not
accomplish what you want.

Steve