Re: how to create domain policy to restrict users ???

You can use the Restricted Groups policy (Computer Configuration, Windows
Settings, Security Settings, Restricted Groups) to set local group
membership on workstations (see http://support.microsoft.com/?id=810076).
User accounts that are only members of the Local Users group can not
"install" software.

Unless a user's account is a member of one of the Local Groups (e.g.
Administrators, Power Users, Users), they won't be able to logon locally.
If a user can not logon locally, they won't be able to use their workstation
at all, so I don't quite understand what you are attempting to accomplish
with your item 2. By default, the Domain Group "Domain Users" is added to
the Local Group called "Users" on Windows XP computers, but you can remove
the Domain Users group if you want. By default ordinary "Users" can not
logon to Domain Controllers locally.

--
Bruce Sanderson MVP Printing
http://members.shaw.ca/bsanders

It is perfectly useless to know the right answer to the wrong question.



"Kresna Rudy K" <KresnaRudyK@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:5005BA04-26EF-4DC0-917D-4EDC4B53FC93@xxxxxxxxxxxxxxxx
> Hi,
>
> I have win2003 as domain controller and 100 pc with win XP.
>
> My questions are :
>
> 1 : How to create domain policy to prevent users to install software ?
> (ofcourse only admin can install new software)
> 2 : How to create domain policy to prevent users to login locally ?
> 3 : Is it possible to disable floppydisk and cdrom via domain policy ?
>
> please help ....
>
> Thanks...
>


.

Relevant Pages

  • EnumLocalGroup - fails when "NT AUTORITY/SYSTEM" is member of group
    ... On Error GoTo 0 ... Enumerate members of the local group. ...
    (microsoft.public.windows.server.scripting)
  • Re: How to configure local PC group membership via Group Policy?
    ... key the name of the Domain group you ... want to added to the local group. ... Don't put anything in the "Members of this group" box. ... > First is Add Group (I'm assuming I need to create a security group ...
    (microsoft.public.windows.group_policy)
  • Re: Breaking Ground - the 70-290
    ... Add the Univ groups is added to each domain local group. ... Global catalog bandwidth utilization should be minimal transfering ... The goal is to minimize replicating changes between forest members so you ... Universal Group impacts the Global Catalog I would put the individual ...
    (microsoft.public.cert.exam.mcse)
  • Re: Manage computers
    ... > using Restrictive Groups that all 'current' members of the local group ... rights for the OU's in which these computers reside. ...
    (microsoft.public.win2000.active_directory)
  • Re: User list in a lcl group
    ... Check SHOWMBRS and SHOWGRPS in the W2K Resource kit. ... a list of users in local group in windows explorer? ... ask for "members" and see names of users that were members ... I am not in domain admin group, but a member of local PC admins group. ...
    (microsoft.public.win2000.general)
Loading