Locking down system...

[BFreshour]

I have a Windows 2k Pro that is going to be stuck out with a group of minions and other nasty creatures. I want to 'lock it down' so the only thing they can access is internet explorer. I'd also like it so that they could only access one site in internet explorer, but that's probably too much to ask.

Things like, removing all icons except internet explorer, disabling task manager, disabling the task bar are things I need to do. Any suggestion or places to read up on this type of stuff?

 

[CharlieJax]

You can delete all the icons right from the desktop (and go into all users under C:\Documents and Settings\All Users\) and delete the shortcuts there as well.

Then you can use the local group policy to lock down their access (via a set user name or group of names). CJ
- Jr. Rocket Man

 

[Guest_imported]

I always had good luck with policy editor.

http://support.microsoft.com/directory/article.asp?ID=KB;EN-US;Q269799&

There are numerous other third part Apps out I think. I am not really sure if TweakUI gives you the ability to lock down or not...I would give it a try.

 

[AndrewBillits]

there is a program called fortress. It's really good. If I can find the link i will post it

 

[BFreshour]

Can someone explain how the gpedit.mmc works? I loaded it under administrator and couldn't figure out how to load a policy for a user or how to create a new one. I ended up locking myself out of every application but iexplore.exe so now I'm rebuilding that box. Any help would be appreciated...

 

[focus20]

Regarding gpedit.mmc, if you want to lock down each PC locally, then you need to use the old NT4 Policy Editor - groups policies will only work in a domain/Active Directory. Storing an ntconfig.pol policy file deep inside the System32 folder will do the trick (I can find the exact path if you need it) - PolEdit won't do everything you need, but it will be a good start, removing icons, cutting back the start menu etc

 

[kgreer]

I need be able to lock down a user on a Windows 2000. The user only needs access to Internet Explore, everything else should not be visible.

 

[hayes47]

If you want to lock down just this pc use the Microsoft Management console that is native to W2k. Start\Run\mmc. click on console in upper left corner and choose add\remove snap-in. At next screen click add and then scroll down and hi-lite group policy and add it to the console. You can then set local policies on a myriad of items for the computer and the user.

 

[ksdadguy]

Does anyone know how to get the 'lock desktop items' option to appear when i right-click on desktop. The only way i can get it to show up now is if i opt on 'Show Web Content'

i tried going through gpedit and adding reg keys, but to no avail. am i doing something wrong?

thanks in advance for your help