How to apply local policy in workgroup ennviron 1

[mufaza]

Hi,
Is there a way to apply local policy for users except administrators in windows 2000 Pro workgroup environment?
I have checked thru support.microsoft.com and found this KB article 293655. I am able to follow the article till step 12. Step 13 when i log in as user its back to normal. No restrictions are applied to the user account.

Is there any other way around to apply polices for users only and not for administrators.

Thanks

 

[bcastner]

The "Everyone but the Administrator" trick:

You use the security settings of NTFS to remove all permissions of Administrator from the folder c:\winnt\system32\GroupPolicy

Remember as Administrator you need to add yourself back to modify local policies, then remove yourself from the folder again.

This results in local policy applying to everyone except the Administrator.

 

[mufaza]

Can you pls elaborate on how to change/remove the NTFS permission for administrator accts. Thanks

 

[bcastner]

In Windows Explorer, right click the folder c:\winnt\system32\GroupPolicy and select Properties.

Under the Security tab, either:

. Uncheck all permissions for the Group Administrator
. Uncheck all permissions for the user Administrator
. Or completely remove both groups from the security window

 

[mufaza]

It surely works !!!Great...i had gone thru as i said 293655 article from support.microsoft and it didn't do its trick. Anyways the only issue i still face is to block or restrict hard drives from being viewed by clients. I was thinking would a logon script do the needful of blocking the user from usage of c:\ and just use g:\ for saving and downloading files? If so what command would the script contain.
BTW some of the items disabled are still being viewed even when logged as user. Eg: right click on 'My computer'
Thanks Mufaza.

 

[bcastner]

There are group policy objects to hide the drives, or use TweakUI.

Be careful, as the NTFS permissions that would prevent the drive from being viewed would also prevent the drive from being accessed to run programs.

There are also Third Party tools that can "hide" folders.

 

[marcdoyle]

using policy editor/registry editor you can remove the "my computer icon", remove the right mouse button menu, remove the start menu "run" option and remove the address bar within windows explorer/internet explorer so they can't type paths there. You can also remove their ability to run "explorer.exe" which would stop them from accessing any folders except through your own shell.

_____________________________________________________________________________________________________________________
There are 10 kinds of people in the world; those who understand binary and those who don't.