Re: Windows 2000 Professional Group Security (Limit Scope)

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 03/03/04 

Date: Wed, 03 Mar 2004 16:08:05 GMT

There are two possibilities as described in the links below. Configuring deny
permissions to the \winnt\group policy\user folder for the administrators group
usually works keeping in mind that permissions will have to be changed back to
further modify policy. Another thing that may work is to logon to a non locked down
computer with the logon name/password of an administrator of a locked down machine
and use mmc /Group Policy -another machine snapin to manage Group Policy on the
locked down machine remotely. Be sure to test out possible solutions on a lab
machine. --- Steve

http://www.jsiinc.com/sube/tip2400/rh2492.htm
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q293655&

"Ryan Palkovic" <r_palkovic@hotmail.com> wrote in message
news:5e6f01c400ed$50904da0$a401280a@phx.gbl...
> My objective is this:
>
> Severly and structurally limit access to users on a
> standalone PC running windows 2000 professional in a
> retail Point of Sale enviroment.
>
>
> Solution that worked:
>
> Use gpedit.msc to limit various actions within the
> operating system.
>
>
> Reason solution as it is is unusable:
>
> Not only did it restrict access to the user account, it
> also restriced access to the administrator account.
>
>
> Question:
> I need to know how to limit the scope of a Group Policy
> object within a standalone Windows 2000 Professional
> machine. Any help would be greatly appreciated.

Relevant Pages

  • RE: services running in windows domain (winXP clients)
    ... registry changes and permissions. ... i mean if someone is administrator can change the ... (Maybe create a group policy setting this ...
    (Focus-Microsoft)
  • Re: Admin / Domain Admin rights problem
    ... Make sure that you are logging on as the administrator account and not some ... permissions via computer configuration/Windows settings/security settings - ... Group Policy when done and needs to be linked to the proper OU where the ...
    (microsoft.public.win2000.security)
  • Re: Can permissions on the Local System account be changed?
    ... You need to provide more information about what you're trying to accomplish, or what permissions/capabililties you are trying to give/remove from the Local System account. ... Per user Group Policy Restrictions for XP Home and XP Pro ... >>>> Can permissions on the Local System account be changed or removed ... >> or not I'm the domain administrator). ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Lock down hard drive
    ... You can use Group Policy on a stand alone machine via gpedit.msc but by ... anyone with any administrator credentials can access files that they do not ... have permissions to by taking ownership first. ...
    (microsoft.public.win2000.security)
  • Re: restriction of dial-up connection
    ... One way would be to use Group Policy via gpedit.msc. ... administrator could remove the restriction to make changes. ... will see many options to restrict access. ... > phone number in dial-up connection not to be changed by ...
    (microsoft.public.win2000.security)