Re: Group Policy restrictions

From: Roger Abell [MVP] (mvpNOSPAM@asu.edu)
Date: 11/28/02 

From: "Roger Abell [MVP]" <mvpNOSPAM@asu.edu>
Date: Thu, 28 Nov 2002 02:01:55 -0700

I am hoping Kevin, and yourself, do no mind my
replying to this. What Kevin refers to, and I tried
to add a little to, is to use a Deny of Full Control
on the system32\GroupPolicy directory.

There is another, more laborious way to get some
amount of per-user local policy outside of a domain.
http://support.microsoft.com/?kbid=293655
http://support.microsoft.com/?kbid=325351
outline this for W2k and Windows.Net, but the method
applies just as well in XP Pro. 

--
Roger Abell
MS MVP (Security, Windows), MCDBA,  MCSE both
Associate Expert - Windows XP ExpertZone
http://www.microsoft.com/windowsxp/expertzone
"Max" <medlow@ozemail.com.au> wrote in message
news:6baF9.779$C6.35352@server1.news.syd.ozemail.net...
> Kevin, I have the same problem ( I work in a school and I am at the moment
> preparing some workstations with XP), I would appreciate fuller details on
> what you are doing with the group policy folder and setting up a separate
> user.
>
> thanks max
>
> "Kevin Mendez" <kmendez@co.new-castle.de.us> wrote in message
> news:1869901c29592$0dac8890$8af82ecf@TK2MSFTNGXA03...
> > You have to deny full access to the group policy folder on
> > your system.  This folder is found at %systemroot%
> > \windows\system32.  You ahve to change the file sharing
> > from simple to normal in order to do this.  If you go into
> > windows explorer and then click on tools->folder options-
> > >view and scroll down to where it says "use simple file
> > sharing (recommended)" and uncheck it.  I went through a
> > whole process where I created a seperate user to configure
> > group policies with.  I can give you all the details if
> > you want.  If you can figure out how to remove the
> > printers and faxes icon from the start menu I'd apprecaite
> > the help.
> > >-----Original Message-----
> > >I am using the Group Policy console to restrict access to
> > >some functions within Windows XP.  Unfortunately, the
> > >restrictions are being applied to the Administrator
> > >account as well. The Administrator account is default
> > >account and I have not made any access changes.  How do I
> > >remove the Administrator from being affected by the Group
> > >Policies?
> > >
> > >I am logged in as the Administrator while
> > >enabling/disabling features.  When I restart the
> > >Administrator no longer has access to those features.  I
> > >have checked Microsoft's site and have not been able to
> > >find any solutions.  Your assistance is greatly
> > >appreciated.
> > >
> > >Thanks.
> > >
> > >Hadi
> > >
> > >.
> > >
>
>

Relevant Pages

  • Re: I thought user security was a holy grail
    ... Hi Kevin, I was wondering if I could get you to contact me offline. ... > ' in this example the command prompt is being run as the administrator ... > The next step is to save and make a shortcut in the limited user ... >>>using an admin account. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Unable to login to SBS Server
    ... Error 0x534 occurs when a user account in one or more Group Policy ... contact an administrator in the domain to perform ... Les Connor [SBS MVP] ...
    (microsoft.public.windows.server.sbs)
  • Re: Unable to login to SBS Server
    ... Error 0x534 occurs when a user account in one or more Group Policy objects ... administrator in the domain to perform the following actions: ... Remove unresolved accounts from Group Policy ... Les Connor [SBS MVP] ...
    (microsoft.public.windows.server.sbs)
  • Re: Locking Down A Computer Lab
    ... the account you created that is a member of the administrators ... In the box that pops up, replace Administrator in the "User Name" ... you can hold down the shift key while windows is ... If you plan on using the Local Group Policy to restrict the ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Locking Down A Computer Lab
    ... You can either use the Local Group Policy or, ... Put passwords on both the built in administrator account ... >>>> Windows XP Booklist ...
    (microsoft.public.windowsxp.security_admin)