Re: Group Policy question

You might want to take time to read the thread. System policies is a
reference to what was used in NT4.0/W95/W98/WME. Windows XP uses "Group
Policies" and Local Security Policy that is a subset of local Group Policy.
By default local Group Policy user configuration applies to all users that
logon to the computer that is not a member of an Active Directory domain.
Seree is well aware of this and is looking for a way to apply GP type
restrictions to only selected users on the computer. The Shared Computer
Toolkit does that very well and is easy to install, setup, and free.

Steve


"Pop`" <nodoby@xxxxxxxxxxxxxxxxxxx> wrote in message
news:eBXvhvt9GHA.4376@xxxxxxxxxxxxxxxxxxxxxxx
Woof, another name for my "ignore" list:

TO THE OP:

Steven L Umbach wrote:
System policies is an old way that was used in the pre Windows 2000
days. It still can be used but the Shared Computer Toolkit is a much
better solution that also uses Software Restriction Policies though
in a less configurable state.
BOGOSITY AT ITS BEST THERE!

Be VERY careful and read everything completely BEFORE going the toolkit
route. But keep in mind, imo it's far from what you need right now.
Take particular note of the requirements of installation and
uninstalling it. I think you'll find them quite enlightening. I'd
seriously advise against trying to use it, considering your case at this
point.

To use System policies you will need to
find a copy of poledit.exe somewhere as on an older operating system
or on some web site that may have it.
NO!

Administrative tools is located here:
C:\Documents and Settings\All Users\Start Menu\Programs\Administrative
Tools

In Administrative Tools, you'll find your policy editors and everything
else you may need.

Or
start; programs; administrative tools; should also take you there unless
it's display has been turned off. This is the route I usually use to get
there; it's quick and easy. Policies are extremely useful and powerful
tools for those who will take the time to properly learn them and
implement them.

If you have a navigation problem, post back and describe it; I'll try to
help out if I can.

It's true poledit is old, but it's also true that it's not likely goign to
do you any good. Better to use the intended tools.

You sound like you're handling things correctly and using lots of common
sense; keep it up and you'll learn a lot.

Best luck,
Pop`





Steve

http://www.zisman.ca/poledit/ -- info on poledit

"seree" <seree@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:98A453CF-79FD-40B8-934D-B84A453CECE4@xxxxxxxxxxxxxxxx
Thans to all who responded to my question about group policy and how
to restrict single or multiple accounts on one computer but leave
others out of
these configurations. I do know (thankfully) to not mess with the
registry unless I know for sure what I am doing and first back it
up. I rarely touch
the registry directly unless given direct and cohesive instructions
from a reputalbe sourse like Microsoft Knowlege Base articles. I was
looking at the
help pages in Group Policy and read something about System Policy
and how System Policy should be used to affect single or multiple
accounts on a stand
alone computer or one part of a work group without a server. I am
unsure where this System Policy is located.

I do not, ever, make any changes unless I have first done extensive
research
on the issue. This is what I am doing now with Group Policy. I want
to be able to use it to some degree to lock down the limited account
I created I call "Visitors" which I am using in place of the Guest
Account as instructed
by Steve in other postings. I want to make sure my Visitors do not
download
from the net, install addons, install active x, or use several
sections of the system including the run dialog box, stop access to
network connections,
and other security issues. Most of my Visitors are older teens, and
young adults, my children, who come and want to use my computers yet
are unskilled
and unkowlegable in how they can cause damage and in the past have
created difficulties for me, which I wound up correcting, but only
after great strain
and angst. lol

So, I will follow the link Steve gave and look into that, and hope
one of you can tell me a bit about System Policy and where to locate
this utility.
Thanks again for all your responses and hope to hear from you all
again. Seree
--
seree


"Pop`" wrote:

Ian wrote:
You can also do this with the registry (which is what policies do,
anyway)

IMO You have that backwards: The best way is with policies, NOT by
editing
the Registry. For obvious reasons editing the REgistry should be a
last resort of the only way to accomplish something.


A useful resource: http://www.theeldergeek.com

The best way to do this is with .reg files, which are text
representations of the registry changes you want to make.

Registry "files" ARE text, not representations of text.

Changes to HKEY_CURRENT_USER only affect the logged-on user.
However, if you want to change settings in an account other then
the one that's logged-on, then you need to figure-out which
HKEY_USERS subkey belongs to that user.

A limitation is that this approach won't work for account-security
settings.

Do exercise some caution as it's possible to break the machine by
incautious registry-editing. (Mind you, same applies to policies)

Policies are much less prone to catastrophic changes, and in
general keep any changes that ARE done at least confined to a
specific area. Not so in
the Registry where you can find identical entries in sevearl
differnt places, only one of which may be the one you need to edit.
Jeez!

The Share ... toolkit is NOT for the faint of heart. It also has several
requirements in order to use it, and if the user should decided to
uninstall it, and forgets that there is a detailed procedure in order to
do so (add/remove won't do it in other words), he's in for a bunch of
hassle.

Pop`






.

Relevant Pages

  • Re: Domain Policy
    ... Never changed so many registry ... keys, specially on the PDC. ... manage Group Policy remotely to undo your changes. ...
    (microsoft.public.win2000.security)
  • Re: Registry tatooing
    ... It can list and clean true policies, ... Speed Group Policy Troubleshooting with the NEW GPHealth Reporter tool at http://www.sdmsoftware.com/products.php ... Well, to his disliking, the settings remained. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Group Policy question
    ... I was wondering why my Group Policy Help section would have directed ... Steve, I asked a question, which is just under this one about an account ... I do know to not mess with the registry ...
    (microsoft.public.windowsxp.security_admin)
  • RE: security policy not specified option
    ... Resultant Set of Policy does not in any way change the processing of Group ... processing different parts of group policy. ... Machine parses local policy and applies any settings contained in the ... parses computer configuration settings in those policies. ...
    (Focus-Microsoft)
  • Re: Custom GPO and suggested settings
    ... You can't change what portion of the registry a particular setting lives in, ... The main difference between a policy ... moves out of scope of a Group Policy the registry ... Policies are generally considered to be 'better' than preferences. ...
    (microsoft.public.windows.group_policy)