Re: Policy to disable shutdown for one user

In article <d9IImAABVHGEFwK6@xxxxxxxxxxxxxxxxxx>,
philp@xxxxxxxxxxxxxxxxxx says...
In article <MPG.1e820b6f13dd04c4989816@xxxxxxxxxxxxxxxxxx>, Duncan McC
<hard@xxxxxxx> writes
In article <Y1j$HCAU5xFEFwzk@xxxxxxxxxxxxxxxxxx>,
philp@xxxxxxxxxxxxxxxxxx says...
All,
gpoledit and policies are a dark-art to me.

Could a kind soul explain how I can limit one particular account to NOT
have 'shutdown' in the 'shutdown menu' on an XP Pro machine please?

I want them to be able to log off the session, but not shutdown, or
restart the machine.

You can still use a 'domain wide policy' to do this (the easy way in an
SBS enviroment) - but you'll need to create a new OU for this one user,
and put 'em in it. (That's how I'd go about it.)

O.K.

Can you point to a 'Policies' hand-holding example anywhere?

On the Server...
Start, Programs, Administrative Tools, Active Directory Users and
Computers.

Say you've created a new OU under My Business called 'Users' and another
called 'Users No Shutdown'. You've moved all the domain users from the
default Users location to your Users (and could now apply policy to
them).

Another thing I do - You've moved your administrators to a newly created
OU too, called 'Administrators' (I create that OU from the root of the
domain).

Now you have all your Users in an easy to manage location (none of the
other 'default users' (eg. 'Debugger Users', 'ASPNET' etc etc are not in
your way).

Movce your special users you want to lockdown into the 'Users No
Shutdown' OU.

Right click the OU, and select Properties.
Click the Group Policy Tab
Click the New button and name it appropriately, eg. 'No Shutdown
custom' or whatever.
Edit it... and in Group Policy, drill into:
User Configuration, Administrative Templates, Start Menu & Taskbar
Configure the 'Disable and remove the Shut Down command'

Close the GP window and back on the Properties window optimise the
policy as it only affects the User Configuration. So click the
Properties button and tick the Disable Computer Configuration settings
and OK out.

A way that I use to ensure that policy is applying is to create and set
a new policy that enables a custom IE titlebar (text) - and logon and
start IE, and I check that the titlebar says what I set it to! :)

Hope that's all clear as mud! :)

--
Duncan
.