How do I restrict users access to settings? 1

[braddds]

I want to restrict the users ability to change or access settings, ie: display; folders; control panel access; etc. I want to allow them to use only the programs I've setup, with no ability to monkey with settings period. I know it may sound "draconian" but some people just can't help themselves.

I've installed win2000 on a stand alone system with no internet...the system is used for security! I've already setup 'user' accounts so some restictions are in place. I haven't changed it to NTFS yet but that is next.

My knowledge is limited with nt systems...I use them for my home network but security isn't that big an issue in regards to resticting access to settings. Any info or links that can step me though the processes would be greatly appreciated!

thx in advance

 

[braddds]

I guess to answer my own question I found this link:

http://www.tames.net/security/win2ksettings.htm#other security settings

I used the Vivisimo search engine...nice!

If anyone has anything to add I'd appreciate it...thx

 

[braddds]

I jumped the gun a little here! This is for 'hardening' a win2000 system. I still haven't found the answer to that!

Ok I've used most of the recommneded setting to harden the computer but still haven't restricted users from accessing contorl panel and display properties, etc.

Any help, please!?

 

[wolluf]

Have you looked at User Configuration|Administrative Templates|Control Panel in Local Group Policy (run gpedit.msc)? You might also want to look at

http://searchwindowsmanageability.techtarget.com/originalContent/0,289142,sid33_gci842820,00.html

(as policies tend to apply to everyone).

 

[braddds]

thx wolluf

I'll give these a try! I'll let you know how it's going.

 

[braddds]

Thx again wolluf

Your help was not only appreciated but very insightful. I was able to secure the workstation in every way plus many other options I wasn't aware of!!! Win2000 is very cool!

I applied a bios password that, together with your suggestions, effectively would halt all but the more ardent intruder.

Great work!

cheers

 

[zay]

To restrict users on win2000, go to Start|Run|and type in "MMC" a console appears, go to Console|Add/Remove snap in|and then click "add", scroll down to "Local Users and Groups" and work from there.

 

[dpresley]

I just stumbled on this thread.... THANK YOU!!!!! I've been looking for this info for a while..

Thanks

-Dave
Psuedo Network & Systems Administrator

 

[dpresley]

HEY wolluf! I'm running into a problem. The first part of your post is working great. The second however is causing me problems. I cant even FIND the group policy thingie. In the link you provided, on step number 5.
Now i was able to do it on one of our computers, but when i go into our lab, and look for it on those i cant find it. I even did a search for it. All the computers in the building are on WIN2k, but i dont know why they'd be different. Any help/advice would be appreciated.
Thanks...

-Dave
Psuedo Network & Systems Administrator

 

[braddds]

I'm not sure but are you refering to:

"5. In Windows Explorer, Right Click on "%systemroot%System32GroupPolicygpt.ini" and select Properties"

If so I found it by seaching for "gpt.ini" which is the same thing as above.

If that is not what your looking for could you be more specific. Cheers

 

[braddds]

Additional, make sure you enable looking in hidden folders/files or it won't be found! Cheers

 

[dpresley]

thats the ticket.. i searched for it, but i didn't enable look for invisible.. THANKS!!!!

-Dave

 

[dpresley]

WOW!!!!!!!! You ready for this??? Well, i went in and did the thing in GPEDIT.MSC WELL, after i got done with that i went to go do the prevent administrator lockouts. WEll, one of the things i changed was what programs to run. I allowed notepad, illustrator, explorer,photoshop.. basic ones. HOWEVER, it's not letting me run ANYTHING! Good god, what have i done...lol I'm about a hair away from reinstalling everything to include the OS.

HELP!
-Dave

 

[dpresley]

Kids shouldn't play with matches...
Apply that where you want!

-D