policy settings for stand-alone pc

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I have a stand-alone (i.e. non-domain) pc running xp pro. There are multiple
user accounts most of which are set to "limited". But I want to make further
restrictions on what such accounts can see and/or do. The type of things that
a group policy would normally control if the pc was in a domain. Is there an
easy way to do this?

I looked at local policies but these appear to apply the same settings to
all users, even members of the admins group!

I tried to use a logon script to set the registry settings that a group
policy would normally set but that failed because a "limited" user can't
write to the registry!

I think I can do a "runas" in vb.net (maybe scripting too?) so maybe I could
call my .net application from my login script? But this seams alot of work!

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

....but surely this will end up with all users (including my account and the
administrator account) having the same group policy settings. I want members
of different groups to have different settings. Can this be done?

"Malke" wrote:

> Richard wrote:
>
> > I have a stand-alone (i.e. non-domain) pc running xp pro. There are
> > multiple user accounts most of which are set to "limited". But I want
> > to make further restrictions on what such accounts can see and/or do.
> > The type of things that a group policy would normally control if the
> > pc was in a domain. Is there an easy way to do this?
> >
> > I looked at local policies but these appear to apply the same settings
> > to all users, even members of the admins group!
> >
> > I tried to use a logon script to set the registry settings that a
> > group policy would normally set but that failed because a "limited"
> > user can't write to the registry!
> >
> > I think I can do a "runas" in vb.net (maybe scripting too?) so maybe I
> > could call my .net application from my login script? But this seams
> > alot of work!
>
> Make new *groups* that have the restrictions you want. Set the
> restrictions with Group Policy Editor (Start>Run gpedit.msc [enter]).
> Add the users who should belong to that group. Make sure you also add
> yourself and the Administrator to the group.
>
> Malke
> --
> MS MVP - Windows Shell/User
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
>

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I've read the article. It looks to describe exactly what I'm trying to do.
Thanks for your help.

"pardal51" wrote:

> Richard,
>
> Steve Riley has put this in another post, I think this will solve your
> problem...
> **************************************************
> http://support.microsoft.com/defau [...] -us;293655
>
> Steve Riley
> steriley@microsoft.com
> **************************************************
>
>
> "Richard" wrote:
>
> > ...but surely this will end up with all users (including my account and the
> > administrator account) having the same group policy settings. I want members
> > of different groups to have different settings. Can this be done?
> >
> > "Malke" wrote:
> >
> > > Richard wrote:
> > >
> > > > I have a stand-alone (i.e. non-domain) pc running xp pro. There are
> > > > multiple user accounts most of which are set to "limited". But I want
> > > > to make further restrictions on what such accounts can see and/or do.
> > > > The type of things that a group policy would normally control if the
> > > > pc was in a domain. Is there an easy way to do this?
> > > >
> > > > I looked at local policies but these appear to apply the same settings
> > > > to all users, even members of the admins group!
> > > >
> > > > I tried to use a logon script to set the registry settings that a
> > > > group policy would normally set but that failed because a "limited"
> > > > user can't write to the registry!
> > > >
> > > > I think I can do a "runas" in vb.net (maybe scripting too?) so maybe I
> > > > could call my .net application from my login script? But this seams
> > > > alot of work!
> > >
> > > Make new *groups* that have the restrictions you want. Set the
> > > restrictions with Group Policy Editor (Start>Run gpedit.msc [enter]).
> > > Add the users who should belong to that group. Make sure you also add
> > > yourself and the Administrator to the group.
> > >
> > > Malke
> > > --
> > > MS MVP - Windows Shell/User
> > > Elephant Boy Computers
> > > www.elephantboycomputers.com
> > > "Don't Panic!"
> > >