mike1210

ok bit of arsey one. Does anyone know how to only apply group policy to certain users using winodws xp pro. On a standalone computer.

I know this is normally done with 2000 or 2003 server with active directory but just wondering.

im 99% sure this cant be done but if anyone knows of a way or a tool that allows you to do it.

cheers

WRX_Rich

iTrader: (5)

dont bother, you can change the local security policy ( in control pannel, administrative tools) but it will effect all profiles, including administrator which cause's nothing but problems

darlodge

You can deny access to the administrators account for the local Group Policy folder. It works fine.

WRX_Rich

iTrader: (5)

or you could do that ( writing it down in book )

out of interest which is the folder you need to change the rights on

mike1210

windows\system32\group policy

cheers guys i've tried this before but its all in the order in which you do things

run gpedit.msc

then deny the administrators group all the read access in the special permissions (you must disable simple sharing to do this), and it only works on xp pro. you make changes and it will say access denied but dont worry it will make the change its just that its not affecting the admin account

you also create a global group called "group policy", give that the normal read, read&execute and list folder contents rights in the above folder. You can select which users (not admins) will be affected by the group policy. Before hand you should remove the permissions user, cretor owner and power user

darlodge

I remember when I was playing with local policies a few years ago. I locked down a PC so tight nothing worked, explorer.exe was denied

But I'd forgotten to deny Administrators access to the folder so even when you logged in as an admin the same policy applied. Thank god it was a test machine

Darren

WRX_Rich

iTrader: (5)

pmsl thats just what I did and why I said not to bother

we are hopefully working with another it deparment soon,,, they have all the pcs with a local gp but they have to change the gp when they logon as admin this is over 2000 pc's - they say that group policy on there server does not give them what they need..... Im begining to think they don't have a clue.....

darlodge

I can understand if they are saying local polices don't give them wht they need. However how can M$ Group Policies and AD not give them what they need. It has everything that we need and more, its just configuring the bugger

Darren

mike1210

its great when you first apply it to customers. uni im working at now weve gone over to 2003 server with AD and we have locked the homepage and background much to the lectures annoyance. They say things like "i cant do my job with this background, it depresses me" ha ha. Then I log in with with an un-managed account to change a setting or something and they hit the roof saying "OH.....I noticed then that you can change your background, why are you able to if we cant, im filing a complaint about this" blah blah blah. Cheers me up when i get a whingy customer

WRX_Rich

iTrader: (5)

the best one I ve had was It could make my epelepsy (sp) worse......
if you have gone to 2k3 server why use local policy.

WRX_Rich

iTrader: (5)

does this work on win2k

mike1210

im only using local policy on my own pc not in my work, i was seeing if it could be done, tried it before . Im 99% sure it does work on 2000 as it supports the same active directory and such. try run and gpedit.msc, thats for a local policy. yes on a network do it via AD

darlodge

Yep, 2000 has the same built in lcoal groups as XP.

Darren