Re: User Restictions on a Standalone Machine

Outside of a domain, local policy has effect on all machine
local accounts equally. This is changing with the Vista release
(finally, after 6 years of being advised that this is needed)
You may find interest in (the painful to implement hack)
http://support.microsoft.com/default.aspx?scid=kb;EN-US;293655

"Christopher Harrison" <SpamFactory@xxxxxxxxxxxxxxxxxxx> wrote in message
news:1160906994.510156.254930@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hi,

I am running Win2k Professional on a standalone, non-networked machine.
It is to be deployed to users whom I don't want messing with my system!
What I would like to do is have an administrator account, with full
privileges (which I can manage to setup!) and a user account that is
severely restricted. In particular, I don't want them to have access to
the system folders or control panel, or be able to change any settings
-- just run programs (even restrict them to just a few applications,
but that might be asking too much), load/save/print documents and
shutdown the machine!

How do you do this!?

I have read-up on group policies and user profiles and I can't seem to
make the necessary changes to a particular user/group. The best I can
manage, so far, is adding the GPO snap-in to the MMC; but I haven't
messed any further because it implies that it affects the entire
machine, not one particular policy/profile.
Can you even do what I'm asking in Win2k Pro? It would seem an obvious
function of a multi-user OS; but I would have thought it would be at
least somewhat intuitive to set-up...

Many thanks;
Christopher Harrison



.

Relevant Pages

  • Re: The Local Policy of the system does not permit you to Log on Inter
    ... I have logged onto 1 of these pc’s with a Domain Admin account and in Local Policy, I have ensured the deny Logon Locally” is not set, but still no joy. ... I have tested one of the accounts to ensure that remote access is functioning. ...
    (microsoft.public.windows.server.sbs)
  • Re: Win2K Professional Lockdown w/o Domain
    ... You can use poledit in W2k for standalone config. ... a domain local policy affects all account equally. ...
    (microsoft.public.win2000.security)
  • Re: Preventing logon to local accounts
    ... account in place. ... RDC to work from home. ... for the domain I get this error message "The local policy of this system ...
    (microsoft.public.windows.server.active_directory)
  • Re: Logon as a batch job
    ... Don't set this setting in the local policy. ... > In looking through the docs it appears the account I'm ... > Where am I supposed to change this user access right if I ... > have done to fix that scheduled task problem? ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Drag it to the trash...
    ... home directories, how are you, as a admin on a particular box, going to be ... By logging in as SYSTEM and providing the password, I can go to his node that the user is on and make the necessary changes. ... Then the sys admin can make the changes there which affects his account or group membership account. ...
    (comp.sys.mac.advocacy)