How to launch reg file 2

[micky500970]

Hi,

I have 10 xp workstations that I want to lock down. I have used a program called win tweaks to create a reg file with all my changes. These changes disable the desktop, control panel, task manager and so on.

When I run the reg file on a computer it says that some of the changes cannot be made as they are in use or words to that effect. Is there another way to run this file. I tried putting a batch file in the startup folder which calls the file and I get the same message. I was thinking of inserting it in via dos at boot up but I am using NTFS so this is not possible.

The computers are part of a peer to peer workgroup and log on locally as the same username on each. I tried to use the MMC to create a local policy but could not work out how to assign the change to one user account. It would change the settings for the administrator's account as well.

Any ideas would be much appreciated.

Cheers

Mick

 

[LloydSev]

You'll probobaly need to grant the user admin rights to run that file one time.

Computer/Network Technician
CCNA

 

[bcastner]

http://support.microsoft.com/?kbid=315675

http://techrepublic.com.com/5100-6270-1040230.html#

http://www.jsiinc.com/SUBL/tip5600/rh5619.htm

http://www.mail-archive.com/techtarget@lists.techtarget.com/msg00083.html

 

[linney]

Some things to look at.

http://www.dougknox.com/xp/utils/xp_securityconsole.htm

Step-by-step guide: Filter to prevent administrator lockouts.

http://searchwin2000.techtarget.com/tip/1,289483,sid1_gci843035,00.html?FromTaxonomy=/pr/288607

 

[bcastner]

linney,
Have you noticed that both of our attempts to link to the John Hueglin tip are problematic? Here for posterity:

The steps below will work with Windows 2000 and XP to help "filter" the administrator (or anyone else you choose) from being affected by the local Group Policy.

Log on as the administrator.
Click START>>>RUN and enter "GPEdit.MSC" - this will open the local Group Policy.
Configure the appropriate Computer and User settings to "lock down" the machine (i.e. - Remove the Run command).
Close the Policy window.
In Windows Explorer, Right Click on "%systemroot%System32GroupPolicygpt.ini" and select Properties.
Select the Security tab.
Select the "Administrators" group in the Access Control List (ACL).
Select the "Deny" box for Full Control and select OK.
Log off/Log on as the administrator.

Once this task is completed, the administrator will no longer be affected by the local GPO, but all other users will. However, because you have denied yourself permission to read the local GPO, you cannot edit in the local Group Policy on the fly. You must go back in and uncheck the "Deny" permissions on the gpt.ini file prior to making changes to the local Group Policy.

About the author: John Heuglin is Microsoft Windows XP Professional and Windows 2000 Server Instructor at Louisville Technical Institute in Louisville, Ky. He holds N+, CNE, MCP+I, MCSA, MCSE(NT4/2K) and MCT certifications.

 

[bcastner]

Or that one line appears incorrectly in the article:

Replace:
In Windows Explorer, Right Click on "%systemroot%System32GroupPolicygpt.ini" and select Properties

With:
In Windows Explorer, Right Click on "%systemroot%\System32\GroupPolicy\gpt.ini" and select Properties

 

[linney]

That link does seem to move around all over the place and can be hard to locate. I wonder how long before Tek-Tips misplace this page? Your link to the page didn't resolve correctly for whatever reason, my link was working when I checked it 10 minutes ago. But like you say about it being problematic, I have to find a new link every time I wish to refer to it.

 

[micky500970]

Hi guys,

That link did not work for me.Bcaster, your information has put me on the right track. A couple of thoughts:

Can I simply copy the gpt.ini file to the other nine computers?
or do I need to do make the same configurations at each computer?

What is the best way to back up my registry so I could restore if things go wobbly - use system restore feature?

Thanks very much for everybodys help.

Mick

 

[bcastner]

That particular file, gpt.ini, is for controlling Group Policy in the situation in which everyone BUT the Administrator is to be effected by local policy.

To distribute local poliy in a Wokrgroup, see:

http://www.theeldergeek.com/gp07.htm

For the Registry, I use ERUNT:

http://www.larshederer.homepage.t-online.de/erunt