Re: Group Policy question

Thank you Steve, I am checking out the link you provided for Shared computer
toolkit. I was wondering why my Group Policy Help section would have directed
me to a Utility which is difficult at best to locate and use. Seems far too
confusing for those of us like myself who is just trying to learn and
advanced in these areas. Oh, well, I am gratefull for this group for having
answers.

Steve, I asked a question, which is just under this one about an account
which mysteriously lost its status and dissapeared off the welcome screen. It
went from an Admin Account to a Debugger Account. It is my fiance's account,
which he has been using since it was created right after the purchase four
months ago. Thank goodness I had just learned about the comand prompt way of
accessing "control userpasswords2" just the day this occurred. Please check
out that post and tell me what you think. Thanks for responding to my posts,

Seree


"Steven L Umbach" wrote:

System policies is an old way that was used in the pre Windows 2000 days. It
still can be used but the Shared Computer Toolkit is a much better solution
that also uses Software Restriction Policies though in a less configurable
state. To use System policies you will need to find a copy of poledit.exe
somewhere as on an older operating system or on some web site that may have
it.

Steve

http://www.zisman.ca/poledit/ -- info on poledit

"seree" <seree@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:98A453CF-79FD-40B8-934D-B84A453CECE4@xxxxxxxxxxxxxxxx
Thans to all who responded to my question about group policy and how to
restrict single or multiple accounts on one computer but leave others out
of
these configurations. I do know (thankfully) to not mess with the registry
unless I know for sure what I am doing and first back it up. I rarely
touch
the registry directly unless given direct and cohesive instructions from a
reputalbe sourse like Microsoft Knowlege Base articles. I was looking at
the
help pages in Group Policy and read something about System Policy and how
System Policy should be used to affect single or multiple accounts on a
stand
alone computer or one part of a work group without a server. I am unsure
where this System Policy is located.

I do not, ever, make any changes unless I have first done extensive
research
on the issue. This is what I am doing now with Group Policy. I want to be
able to use it to some degree to lock down the limited account I created I
call "Visitors" which I am using in place of the Guest Account as
instructed
by Steve in other postings. I want to make sure my Visitors do not
download
from the net, install addons, install active x, or use several sections of
the system including the run dialog box, stop access to network
connections,
and other security issues. Most of my Visitors are older teens, and young
adults, my children, who come and want to use my computers yet are
unskilled
and unkowlegable in how they can cause damage and in the past have created
difficulties for me, which I wound up correcting, but only after great
strain
and angst. lol

So, I will follow the link Steve gave and look into that, and hope one of
you can tell me a bit about System Policy and where to locate this
utility.
Thanks again for all your responses and hope to hear from you all again.

Seree
--
seree


"Pop`" wrote:

Ian wrote:
You can also do this with the registry (which is what policies do,
anyway)

IMO You have that backwards: The best way is with policies, NOT by
editing
the Registry. For obvious reasons editing the REgistry should be a last
resort of the only way to accomplish something.


A useful resource: http://www.theeldergeek.com

The best way to do this is with .reg files, which are text
representations of the registry changes you want to make.

Registry "files" ARE text, not representations of text.

Changes to HKEY_CURRENT_USER only affect the logged-on user.
However, if you want to change settings in an account other then the
one that's logged-on, then you need to figure-out which HKEY_USERS
subkey belongs to that user.

A limitation is that this approach won't work for account-security
settings.

Do exercise some caution as it's possible to break the machine by
incautious registry-editing. (Mind you, same applies to policies)

Policies are much less prone to catastrophic changes, and in general keep
any changes that ARE done at least confined to a specific area. Not so
in
the Registry where you can find identical entries in sevearl differnt
places, only one of which may be the one you need to edit. Jeez!









.

Relevant Pages

  • Re: Group Policy question
    ... you're right about the shared computer toolkit. ... but still am unclear on the matter of usability of group policy on ... I had an admin account go missing off the welcome screen ... the registry directly unless given direct and cohesive instructions ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Domain Policy
    ... Never changed so many registry ... keys, specially on the PDC. ... manage Group Policy remotely to undo your changes. ...
    (microsoft.public.win2000.security)
  • Re: Group Policy question
    ... will prevent you from editing Group Policy locally until you grant yourself ... enviroment when my Visitors Account would only be used a few times a year. ... the registry directly unless given direct and cohesive instructions ... System Policy should be used to affect single or multiple accounts on ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Custom GPO and suggested settings
    ... You can't change what portion of the registry a particular setting lives in, ... The main difference between a policy ... moves out of scope of a Group Policy the registry ... Policies are generally considered to be 'better' than preferences. ...
    (microsoft.public.windows.group_policy)
  • Re: TimeOut Script for OWA
    ... Did you test the policy change with a test domain user account? ... You should not 'enforce' a ... My knowledge of Group Policy is limited, ... Modify Account Lockout Policies ...
    (microsoft.public.windows.server.sbs)