Archived from groups: microsoft.public.windowsxp.security_admin (
More info?)
As Malke noted, its is entirely possible to lock yourself out of critical functions with the Group Policy Editor, on a stand alone machine. On a stand alone computer, policies put in place using the Group Policy Editor apply to all users of the machine.
You need to provide more information about what you're trying to accomplish, or what permissions/capabililties you are trying to give/remove from the Local System account.
--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.
"Malke" <invalid@not-real.com> wrote in message news:OypgPZhoFHA.576@TK2MSFTNGP15.phx.gbl...
>J Williams wrote:
>
>>
>> Malke wrote:
>>> johnwilliams_esquire@hotmail.com wrote:
>>>
>>> > Can permissions on the Local System account be changed or removed
>>> > etc. If so, how?
>>> >
>>> > Or are the permissions fixed and cannot be changed?
>>> >
>>> > Thanks.
>>>
>>> You haven't given us enough information to get a specific answer. Is
>>> this a standalone machine or on a workstation connected to a domain?
>>> What version of XP and what service pack level? Are you the domain
>>> administrator?
>>
>> It's for XP Professional SP2. FWIW I'd like to know the answer in the
>> case of a standalone m/c and a box connected to a domain (and whether
>> or not I'm the domain administrator). Thanks for distinguishing those
>> scenarios.
>
> Well, of course you can change permissions. If you have a standalone
> machine running XP Pro (as you do), you can set very fine-grained
> permissions by using the Group Policy Editor.
>
> Start>Run>gpedit.msc [enter]
>
> You need to be logged in with an account with administrative privileges.
> If you want to know more about the Group Policy Editor, then type that
> into XP's Help & Support. Be careful working with the Group Policy
> Editor; it is completely possible to lock yourself out! There is also a
> newsgroup for the Group Policy Editor if you have specific questions
> about it:
>
> microsoft.public.windows.group_policy
>
> If you have a workstation joined to a domain, permissions are usually
> set at the domain level and although there may be a local administrator
> for emergencies, normally regular users would not be able to log in as
> local administrator or set/change permissions on the domain
> workstation. One of the reasons for running a domain is to have central
> control of the workstations.
>
> If you want to know more about domain set up and best practices, this is
> a vast subject. I suggest starting with TechNet, which is a marvelous
> resource:
>
>
http://technet.microsoft.com/default.aspx
>
> Malke
> --
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User
Facebook
Twitter
Instagram