Re: Controlling user access

From: Roger Abell (MVPNoSpam@asu.edu)
Date: 02/24/03 

From: Roger Abell <MVPNoSpam@asu.edu>
Date: Sun, 23 Feb 2003 22:03:32 -0800

"Curious George" <curious.george@zoo.net> wrote in news:006001c2dbbf
$6e939f40$a001280a@phx.gbl:

> I'm running XP Pro, and created limited user accounts for
> my kids. I noticed that when I installed some software
> from my admin account, icons showed up on their desktops.
> I'd like to be able to SEVERELY limit their capabilities
> on the computer (ie: make it child-proof) where they only
> have limited icons to choose from. I'd like to prevent
> them from accessing the start button, or making other
> changes, and I'd like to be able to control what icons DO
> appear on their desktop. Is there a way to accomplish
> this?
>

The icons appear on their desktop and/or in their start
menu because the installer placed these into the All Users
profile in Documents and Settings. If you wish, copy these
from the All Users profile to the corresponding location in
the profiles of all accounts that should have them, and then
delete these from the All Users profile. Do not move them,
copy them and then delete so that the copies will receive
the premissions appropriate for the profile being copied into.

You can lockdown much of the user interface using the Local
Security Policy of XP Pro. However, what you do there will
affect all accounts, not just the kids account(s). To get
around that pitfall, set a Deny of Full Control on the folder
system32\GroupPolicy for accounts that should be exempted
from the policy settings. Now, since your admin account is
one of these and is denied access to this folder after you
do this, it will not be able to edit/change the policy settings.
So, you will have to temporarily remove the deny when you do
want to change the settings - and remember to replace the deny
when done. 

-- 
Roger Abell
MS MVP (Windows Security)