Re: Locking computers down so that users cannot change any settings

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 10/30/04 

Date: Fri, 29 Oct 2004 22:54:04 GMT

If you look in Group Policy under user configuration/administrative
templates/desktop and configuration/administrative templates/start menu you
will see a lot of options you can try. For the desktop settings note that
they differ depending on if you are using Active Desktop or not. Other
options may be to use mandatory user profiles or changing the users
permissions to their desktop folder in their user profile under documents
and settings so that they have only read/list/execute. Restricting Desktop
settings alone, while it has it's merits, will not do much to secure your
network For that you also need to configure strong password policy,
restrict users to the users group if possible, apply the principle of least
needed permissions to resources such as shares, have a firewall, antivirus
protection, and take many other steps. If you have Windows XP Pro computers,
you will find Software Restriction Policies very helpful in preventing users
from installing or running unauthorized applications.The links below may be
helpful. --- Steve

http://support.microsoft.com/?kbid=323368 -- assigning mandatory profiles.
http://www.microsoft.com/smallbusiness/gtm/securityguidance/hub.mspx --
Microsoft Small Business Security Guidance.

"Needy1" <Needy1@discussions.microsoft.com> wrote in message
news:E2C52234-8FFC-4D13-AE79-F96EB2228E63@microsoft.com...
>I do not want my users to make any setting chages in the workstations. I
> want there to be a standard and people cannot change desktop settings. I
> need to know which OU policies I need to enable or disable to secure my
> network.
>
> Please Help! Thanks.

Relevant Pages

  • RE: Several Problems; how to reset security and troubleshoot serve
    ... On the SBS security settings; I accept your response, ... On the Remote Assistance Issue I have check all of the settings as you ... What started me on the path of security problem was I had a simular problem ... Start the Microsoft Management Console Group Policy snap-in. ...
    (microsoft.public.windows.server.sbs)
  • Re: iNTERACTIVE LOGON welcome screen - make it go away
    ... I created a custom ADM file for these two settings ... and imported it into the GPO under the Computer Administritative templates. ... really great expertise in Group Policy often reply to posts including ... doing a gpupdate on that domain controller which ideally would be the ...
    (microsoft.public.windowsxp.security_admin)
  • Re: group policy scrolling marquee
    ... Policy at the same time a great robust platform for configuration management ... is launced via one of the four events available through Group Policy but the ... to store their settings in one of two places. ... > As for the Marquee screen saver you'll note that the settings (including ...
    (microsoft.public.win2000.group_policy)
  • Re: File sharing
    ... When you run rsop.msc you will get a report screen showing Group Policy ... connections/Windows Firewall and what settings from what Group Policy. ... setting to accept connections on the local subnet plus connections from my ...
    (microsoft.public.windowsxp.security_admin)
  • RE: How to enforce Remote Assistance and Remote Desktop via GPO?
    ... By setting the GPO status to "user Configuration Settings Disabled" then ... I understand that you want to enforce remote ... assistance group policy settings and remote desktop group policy settings ... To enable remote desktop and remote assistance on specific Windows XP ...
    (microsoft.public.windows.server.sbs)