How to disable access for certain users??

[Philo]

Hi All,
Can i get some advice on how to disable access to control panel, display properties etc for certain users?

Background is i'm setting up a network for a school were we will be running a number of systems with a basic file server. What i would like to do is to restrict access to the control panel etc for the students so they can't change settings etc Can someone please advise?

Regards

Philo

 

[blue68f100]

What OS are you using?

XP has the capability of restricting users. Mac OS X can do that too.

When you do that you have to lock the BIOS boot order and password protect the bios. On XP you will need to add a PW to the Admin account. Ad do not use and dictionary or proper names. The password must be purely random. Like GRC password generator.

The best way to restrict www is not have it connected. Believe me kids will try to circumvent any restriction you impose. A I would dare to venture they proably know more than you do when it comes to that.

And most routers allow you to set up rules and schedules.

 

[Philo]

Hi,
Thanx for your response. The OS will be XP Pro. I know in Xp you can seup restricted accounts but i'm not sure if it allows you to stop access to control panel, display properties etc.

You can get third party software to disable these features or edit the reg but i don't wanna go that way.

Regards

Phil

 

[blue68f100]

I have the home addition. Run a simle test with a limited user account and see what can be changed or modified. It's been a while since I set members up as limited account. I did know it blocked certain cmds. I think it allow control panels to be displayed but did not allow changes.

 

[Philo]

Hi,
I set up the limited account and it does restrict some features, but not on the scale i require. All school and public access computers e.g internet cafes have these strict or limited access.

maybe someone can point me in the right direction


Regards

Phil

 

[Hawkeye22]

Give them all restricted access accounts. From an administrator account do a "start/run" and type in gpedit.msc. Some access can be restricted from there.

 

[sturm]

What kind of network are you using?
If your running domain controllors you can set up restrictions using group policy editor. When the student/person logs in the computer will read their group policy and apply all the settings for that login. You can restrict to your hearts content with GP.
If you run group policy on the stand alone machince it will effect every account, including the admin account. I tried this at my school to restrict the students access. Was more of a pain when I had to fix the computer and had to reenable all the stuff I needed then disable it again when I was done. Eventually just gave up.
Now that the school is switching over to a windows network hopefully the network admins will put some restriction on the accounts.

 

[Guest]

Hi i am having 5 systems and not having any server for it.. But i have 3 user such as Admin, Staff and Student... I had made the other user as limited except the Admin... Now i want to disable the net connection and usage of pendrive in the student login alone ... Pls help me for this....

 

[seacliff]

The best way to restrict www is not have it connected. Believe me kids will try to circumvent any restriction you impose. A I would dare to venture they proably know more than you do when it comes to that.

I do agree with that. One good way would be to lock the admin account, and then use gpedit to block whatever you want to. I would suggest you to use a domain controler to lock everything.

Another way you could do that, would be to not lock the workstation, but freeze the disk using some apps like DeepFreeze. It does work great in school. A reboot, and you don't have to worry about what was done before.


cheer,

 

[mark mv]

[FOR WINDOWS 7]
run gpedit.msc
go to USER CONFIGURATION - then ADMINISTRATIVE TEMPLATES then CONTROL PANEL then open the option PROHIBIT ACCESS TO THE CONTROL PANEL then choose ENABLED. and you are done

 

[bill001g]

Mark you need to keep a eye on the dates in these posts you have replied to a number that have not been active in a year or more