Group policy

[UNIX72]

I have to lock down 30 pc's with windows 2000 professional. Has anybody use gpedit? I want the policy to only be local to the workstation. Does not need to communicate to active directory or server, just local. My desire setup is just to have 2 applications on the desktop that's all. Sounds easy but mostly the documentation refers to group policy with AD. Does anybody have links or good configs to give, thanks.

 

[kjmattson]

Using gpedit on a workstation is really no different than configuring an AD GPO except that you are going to have to hit each workstation. The interface is the same and the options are mostly the same. With 30 pc's though I would really rethink about doing this through a GPO instead. Each time you need to make a change you will have to deal with 30 pc's.

It really depends on how much you want to lock it down and what these pc's will be used for. I would disable control panel, task manager, task scheduler to start with and make the user profile mandatory. I like to lean toward disabling as much as possible and then make sure that the user can still do what they need to. Kevin Mattson
MCP

 

[UNIX72]

Thanks for the response but I just need to log the pc local no Active directory. Do you know of any good documentation links.

 

[kjmattson]

I found this book helpful, but of course it is not free.

http://www.pearsonptg.com/book_detail/0,3771,0735709750,00.html

On this page there is a link to download a document that has a lot of information about WIndows 2000 group policies. The section towards the end of the document regarding setting up a ZAK client is probably what you are looking for to lockdown your desktop environment.

http://www.microsoft.com/windows2000/techinfo/howitworks/management/grouppolwp.asp

Kevin Mattson
MCP