Group Policies

[grez]

Just really diving into group policies on a standalone machine here for the first time. I see that once you set the policy (enable X policy), that will apply for ALL users, including the administrator. In reviewing the XP Inside / Out book, it states that you can set administrator (or any account) read access to "deny" and the policy will bypass that user, and that user will have access. Tried that, works, BUT, after resetting "deny" to "allow", I still can not get back into the group policy editor. Tried everything I could think of to get back in, but no go. (any thoughts on this one??, but main question is below).

With that all said and done, I do not want to try this on a client machine. So, the question is this:

1)Is there any other way of bypassing this?

2)Or, is it just better to log in as admin, load up the gpedit.msc, disable the policy that I need to address, do what I have to do (say, add / remove programs for example), and then go back in and enable the policy again?

Thanks in advance for your time and efforts!

 

[linney]

See if these make it any clearer.

http://searchcio.techtarget.com/tip/1,289483,sid7_gci843037,00.html?FromTaxonomy=/pr/1295

How to apply local policies to all users except administrators in a workgroup setting in Windows 2000

http://support.microsoft.com/?kbid=293655#appliesto

325351 - HOW TO: Apply Local Policies to All Users Except Administrators on Windows Server 2003 in a Workgroup Setting

http://support.microsoft.com/default.aspx?scid=kb;en-us;325351&FR=1&PA=1&SD=HSCH

You might be able to avoid some GPO settings just by making sure any user is a Limited User and not an Administrator (certainly limitation would be applied to the example you mentioned).

Here's a bit of information, a mountain of it is available via Google, and don't forget Help and Support. I have tried to arrange the links from basic to complex. Hope it helps you.

http://www.sans.org/rr/paper.php?id=313

http://www.theeldergeek.com/group_policy_for_windows_xp_prof.htm

http://www.microsoft.com/windowsxp/pro/techinfo/planning/security/whatsnew/propart3.asp

http://www.microsoft.com/windows2000/techinfo/planning/security/secconfsteps.asp

 

[bcastner]

And in the alternative consider Dough Knox's Security Console utility:

http://www.dougknox.com/xp/utils/xp_securityconsole.htm

 

[grez]

Thanks for your help on this. I wound up reformatting (this is only a test machine anyway). Tried to reset the security settings as per one of the links from linney, but that did not do the trick. I did order and try out Doug Knox's Security Console.....problem solved. This makes it not only easy, but really wraps it tight!

Thanks guys!!!!