Re: I asked this before, Group Policies

From: Roger Abell [MVP] (mvpNOSPAM@asu.edu)
Date: 04/18/03 

From: "Roger Abell [MVP]" <mvpNOSPAM@asu.edu>
Date: Fri, 18 Apr 2003 06:01:59 -0700

What do you mean by restrict the local groups ?
Change what they allow, or change what accounts
are within their memberships, or . . . ? 

-- 
Roger 
"koz" <jkozlowski@pwdc.org> wrote in message news:048501c30505$47188330$2f01280a@phx.gbl...
> Interesting, I will try this out.
> 
> Is there a way to restrict the local groups also, like 
> power users and such?
> 
> Thank you again,
> 
> koz
> 
> 
> >-----Original Message-----
> >"koz" <jkozlowski@pwdc.org> wrote in message 
> news:028901c304e5$9d1b4da0$3301280a@phx.gbl...
> >> I'm trying to use group policies, restricting 
> >> local/network users to certian policies, but not 
> >> restricting Administrators.
> >> 
> >> example:
> >> local/network users:
> >> remove run
> >> remove control panel
> >> 
> >> Administrators/network administrator
> >> run
> >> control (are in start menu)
> >> 
> >> thanks for the help
> >> 
> >> Koz 
> >
> >
> >  It is crude, but you can Deny Full Control, to those 
> accounts 
> >  that should not be impacted by local policy, on the 
> directory 
> >  system32\GroupPolicy.  For an admin to modify the 
> settings 
> >  in policy they need to have the Deny effecting them 
> removed, 
> >  and then replaced when finished with the edit.
> >
> >  In some cases the method outlined in KB 293655 is of 
> use 
> >    http://support.microsoft.com/?id=293655 
> >
> >  For some settings you can adjust things directly with 
> >  registry edits for effects limited to only some users.
> >
> >  Other than these (and third party products that use 
> these, 
> >  mostly registry manipulation, for you) local policy 
> will 
> >  always function as it is designed to do - uniformly 
> apply 
> >  settings to all accounts.
> >
> >  -- 
> >  Roger Abell
> >  MS MVP (Security, Windows), MCDBA,  MCSE both
> >  Associate Expert - Windows XP ExpertZone
> >  http://www.microsoft.com/windowsxp/expertzone
> >
> >.
> >

Relevant Pages

  • Re: Blocking Accounts on Certain PCs
    ... As long as you're using passwords that are widely known, no, you can't stop anyone from using the computer. ... Through your domain policies, you can restrict, I believe, what machines a particular user can log on to. ... > We can't use private passwords on these accounts. ... >> Windows XP - Shell/User ...
    (microsoft.public.windowsxp.security_admin)
  • how to restrict or deny hard drive(s) access for guests/users accounts
    ... i am setting up user passworded accounts and 1 guest ... accross different hard drives. ... 'restrict access to folders' ...
    (microsoft.public.windowsxp.security_admin)
  • per user authentication types?
    ... Can I restrict authentication types for specific users? ... I want to restrict most accounts in so far, that they can only be accessed if public key authentication was used; and only allow password-authentication for a few specific accounts. ...
    (SSH)
  • Re: Nt 4 BDC upgrade
    ... local groups to a specified file and make a whole bunch of user ... accounts in the new domain. ...
    (microsoft.public.windows.server.migration)
  • RE: Group Policy in non-domain envronment
    ... Can I apply policies to individuals (or local groups) on a local ... I want to restrict certain users from doing certain tasks, ... There is tons of info on Group Policies, but I have yet to find out how to ...
    (microsoft.public.windowsxp.security_admin)