Re: desktop lockdowns

Hi,

Im fine setting up default user profiles.

Im one of the system admins for my company, so would like to get a better
understanding of the proceedure. The question was originally posted in
respect of a spare laptop which is just reinstalled but I dont want it coming
back each time with scooby doo backgrounds, spyware installed etc.

Also going to attempt to take the MCP at some point so trying to patch any
areas that Im weak on before I do.

"Nepatsfan" wrote:

> Seeing as a domain is involved, this is a question you should
> probably post to one of the server newsgroups. The people who
> answer questions there have a lot more experience dealing with
> these issues.
>
> That said, here's my advice. Get a trained professional to set
> this up for you. The money you save doing it yourself will cost
> you more time, effort and energy than it is worth.
>
> You might want to read these articles to get an idea of some of
> the things you would have to do in order to accomplish your
> goals:
>
> Create a default user profile that you can use as a template.
> http://support.microsoft.com/?kbid=319974
>
> Create mandatory user profiles on your server.
> http://support.microsoft.com/?kbid=307800
>
>
>
> --
> Nepatsfan
> "AmyAmandaAllen" <AmyAmandaAllen@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote
> in message
> news:92EF3726-0B45-4634-B9EC-F8A9AB4B4B57@xxxxxxxxxxxxxxxx
> > Thanks for replys
> >
> > Having had a look around I did later realise that it was domain
> > based as a
> > standalone only has 2 types of account.
> >
> > Any idea how to make a default user profile on a xp machine
> > that is part of
> > a network, that can be locked down alot more? or how to make a
> > new account
> > type |( eg like power user that can be saved and run soon as my
> > users log on
> > to their pc's?
> >
> > Tahnks alot
> >
> > "Nepatsfan" wrote:
> >
> >> Group policy is something that is most effective in a domain.
> >> While you can use it on a standalone machine, the downside is
> >> that by default the settings apply to all users. It's possible
> >> to
> >> exempt individual users and/or groups from policies set in the
> >> User Configuration section of the local group policy but it's
> >> not
> >> an easy procedure. If done incorrectly there's a small chance
> >> that you could lock yourself out of the computer.
> >>
> >> Here are some articles that might be helpful.
> >>
> >> Lockdown by group using Local Computer Policy without Active
> >> Directory:
> >> http://tinyurl.com/687jj
> >>
> >> This applies to XP as well as Win2K:
> >> http://support.microsoft.com/default.aspx?scid=kb%3Ben-us%3B293655
> >>
> >> Local Group Policy in a workgroup:
> >> http://www.theeldergeek.com/gp07.htm
> >>
> >> Here's an alternative to using Group Policy:
> >>
> >> http://www.dougknox.com/xp/utils/xp_securityconsole.htm
> >>
> >> You might want to consider using this program first. If it
> >> doesn't give you enough options then consider making changes
> >> to
> >> the local group policy. If you decide to go the GPO route,
> >> post
> >> back if you have questions on individual policies.
> >>
> >> --
> >> Nepatsfan
> >> "AmyAmandaAllen" <AmyAmandaAllen@xxxxxxxxxxxxxxxxxxxxxxxxx>
> >> wrote
> >> in message
> >> news:B2A8C6C9-95CC-4702-9BA8-0863C75CF773@xxxxxxxxxxxxxxxx
> >> > Hi, new to these forums...
> >> >
> >> > looking for some info please.
> >> >
> >> > I have a XP laptop that is stand alone. I have an
> >> > administrator
> >> > account
> >> > installed and also a default customised profile setup for
> >> > all
> >> > users who log
> >> > on. However they can still change settings and screw the
> >> > laptop
> >> > up.
> >> >
> >> > Im trying to create a custom user group ( that would be
> >> > selectable like
> >> > user, power users, restricted, administrator etc ) that
> >> > would
> >> > use something
> >> > like group policy, but locally to let me restrict things
> >> > like
> >> > changing the
> >> > desktop, adding programs, being able to see the control
> >> > panel
> >> > etc for all
> >> > users that log on ( except me ). This looks like it can be
> >> > done with group
> >> > policy but Im not sure how to implement it.
> >> >
> >> > I've tried the knowledge base but dont really know what to
> >> > ask
> >> > , something
> >> > to do with templates me thinks
> >> >
> >> > Thanks guys
> >> >
> >>
> >>
> >>
>
>
>
.

Relevant Pages

  • DeleteRoamingCache key on Vista Enterprise
    ... I have Windows Server 2003 with a group policy object containing the option: ... have also attempted using supermandatory user profiles, ... GPO: Vista Computers Group Policy ...
    (microsoft.public.windows.group_policy)
  • Re: Locking computers down so that users cannot change any setting
    ... you should have good success with Group Policy as I mentioned ... work for those settings that apply to Windows 2000 computers. ... >> options may be to use mandatory user profiles or changing the users ...
    (microsoft.public.win2000.security)
  • Re: Roaming Profiles
    ... configuration group policy on client computer will not be an efficient way ... Group Policy Settings for Roaming User Profiles ... This newsgroup only focuses on SBS technical issues. ... you may want to contact Microsoft CSS directly. ...
    (microsoft.public.windows.server.sbs)
  • RE: Deleting user profiles via Group Policy
    ... If you refer to the normal local user profile, ... Deleting user profiles via Group Policy ...
    (microsoft.public.windows.group_policy)
  • Re: desktop lockdowns
    ... If you're users have local accounts on the laptop then you might ... run gpedit.msc to launch the local group policy editor. ... of the Administrators group, do the following: ... >> Create mandatory user profiles on your server. ...
    (microsoft.public.windowsxp.setup_deployment)
Loading