Restricted Groups and Limited Admin Rights

[Bigtm]

Hello, I have setup a restricted group and associated a GPO. Although I intended these users to be local admins on my XP workstations, through the GPO I have taken out or restricted several features including access to networking, certain control panel applets, Internet settings etc. My question is this,

How can I stop these local admins right clicking on My Computer and selecting manage. I have taken out the properties option and I require that the manage option is also disabled. All other items on the menu can remain. I don't want these local admins to be able to create or amend user accounts.

I can't see any obvious setting within the GPO that I need to set.

My aim is to create a limited amount of users that can install/uninstall software and hardware and require the ability to modify the Windows System Directories as part of some installations. Power users are limited in what they can do. Any ideas? Is there a better way than local admins through restricted groups and were can I find the mentioned settings?

Many Thanks,
BigTM.

 

[58sniper]

If you deploy software via GPO, you wouldn't even have to touch the machines for software installation.

Pat Richard
Microsoft Exchange MVP

 

[LawnBoy]

There is also the runas command, where a process can be run using an admin's credentials.

"We must fall back upon the old axiom that when all other contingencies fail, whatever remains, however improbable, must be the truth." - Sherlock Holmes