Public and Administrative users on the same machine

[Dizzutch]

Hi,
We're running Microsoft NT 4 Service Pack 6, and MS Windows 2000 on our public terminals. Now we're creating new images for the public machines where we want 2 users. "public" and "admin". Now when "public" loggs in we want the desktop to be empty, no icons, no nothing, and no permissions to install, or do anything on the machine. While the "admin" account must be adble to act like an Administrator on the machine. So we do want icons a full Start Menu etc. What is the best way to accomplish this? I've tried working with MMC but when i can only edit public's group policy when public is an admin, but since it's group policy the entire group is affected. However when i edit the policy as admin i cannot change the policies for just public.
TIA.

 

[MattWray]

Do you have these machines networked? With a Domain, this would be very simple. You create an OU for Public and one for Admin. Create the policies and link the appropriate one to each OU. Then add the user public and admin to the repective OU's. I'm not sure if you can do this locally for each machine or not....

Thanks,

Matt Wray
MCSE, MCSA, MCP, CCNA

http://www.sss-steel.com

http://www.total-tec.com

 

[Dizzutch]

Yes, all the machines are on a domain, so you're suggesting we create the users on the server, and have the terminals download the profiles every time. What exactly do you mean by an OU? I'm quite new to Windows Management.
TIA

 

[MattWray]

What kind of terminals are you using? Are they windows boxes, or straight dumb terminals?
Anyways, OU is an Organizational Unit. In the AD snap-in, right-click your Domain and choose New-> Organizational Unit. Make one for Public and one for Admin. You can then create a Public user in the Public OU and an Admin user in the Admin OU.
From there run MMC and choose Add/Remove Snap-in from the Console menu. Add the Group Policy snap-in. Browse to the Public OU and click OK. Thenlock it down as much as you want, and do the same for the Admin OU.
Then once in AD, you can right-click your OU-> Properties-> and choose the Group Policy tab to edit or add new policies.....

Thanks,

Matt Wray
MCSE, MCSA, MCP, CCNA

http://www.sss-steel.com

http://www.total-tec.com

 

[Dizzutch]

Ah, ok, well we don't have Active Directory Installed, but we have managed to get the desired result by making a public domain user, and on the server, and using System Profiles we have been able to tighten the security.

Thanks alot.

 

[MattWray]

OK, great!
I should've checked what kind of server you were using up front, glad you got it...

Thanks,

Matt Wray
MCSE, MCSA, MCP, CCNA

http://www.sss-steel.com

http://www.total-tec.com