Re: Multiple Local Group Policies

What you are doing is not a very good idea and I am not surprised you are
having problems and would not be a supported procedure by MS. Ideally such a
lockdown would be done on a computer that is a member of an Active Directory
domain. However Microsoft offers the free Shared Computer Toolkit that may
be able to do all or most of what you want by being able to lockdown
individual user accounts. To restrict access to applications and folders you
should be modifying NTFS permissions to manage user/group access. ---
Steve

http://www.microsoft.com/windowsxp/sharedaccess/default.mspx ---
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx

"MartinSGill" <MartinSGill@xxxxxxxxxxxxxxxxx> wrote in message
news:01CD2A88-63BB-4715-A9AE-C6C44C87C788@xxxxxxxxxxxxxxxx
Hi

We have a computer set up that requires us to (on request) completely lock
down the local computer.

We do this using group policies, by having two group policies and when
required replacing the entire %SystemRoot%\system32\GroupPolicy directory;
either with the original policies or with our updated ones.

We are seeing some odd and erratic behaviour at times, and I'm concerned
about whether this is the best way of doing things, or if there is a
better
way.

Things we need to do include:
Deny access to hard disk
Prevent run command
Limit applications that may be run to a speficied set
and various other restrictions

Does anyone have any suggestions on how this can be done? The important
thing is the ability to reliably switch between one set and the other.

Thanks,

Martin


.

Relevant Pages

  • Group Policy: Default printer & software restriction
    ... Restrict access to only be allowed to execute one or two pieces of ... Another thing I was wondering is if I don't use Active Directory, ... Or if is it that if I dont use AD I can only restrict ... all users are affected by the changes done in the 'group policies' ...
    (microsoft.public.win2000.security)
  • RE: Auto-Configure Search For People in Start Menu?
    ... >the 'Active Directory' enabled as the default, ... >do it with Group Policies, with remote registry, or even with a WMI script? ... If you open the address book, you can import/export the Internet Accounts ...
    (microsoft.public.win2000.general)
  • Re: Automatically locking desktop after a certain period of time
    ... Since you're on Active Directory, force the use of a screen saver and a timeout and password requirement via Group Policies. ... These settings are in User Configuration, Administrative Templates, Control Panel, Display. ... > the computer automatically lock after a certain amount of time (like some ...
    (microsoft.public.windowsxp.security_admin)
  • proper organizational unit setup/examples
    ... My school district is slowly but surely moving to windows ... use group policies, and I know that the term "group ... placing students in groups, such as grade 1, grade 2, ... Active Directory in a school setting and then how to ...
    (microsoft.public.win2000.active_directory)
  • Re: Can a computer administrator deny access to drive A from other users?
    ... Yes, its possible to restrict access to specific disk drives, via Group Policies. ... And while you may be a local Administrator, a Domain Administrator can control what you do and do not have access to. ...
    (microsoft.public.windowsxp.security_admin)