How to prevent users from changing desktop

[mquinn0908]

How can I go about setting up a PC where the user can't change the desktop (adding/deleting icons, wallpaper, display properties, etc). Since this is only for a couple of PC's I was hoping there was an easy way (maybe through the registry) that I can make these changes. I found where you can add the "NoSaveSettings" to the HKEY Current User\software\microsoft\windows\current version\Policies\explorer key and set it to "1" and this would not prevent users from changing these items but when they log off and log back on then it would go back to before the changes were made. I tried this and it doesn't work. We just have a couple of PC's that the public will be using and we want to keep them from changing anything, accessing anything they shouldn't and keep these PC's consistant....any suggestions?

 

[scottew]

If you go to Start/Run and type gpedit.msc, set a local computer policy by going to user configuration/admin templates/display and chose the option to prevent changing wallpaper.

I would use the local computer policy to make all the other changes you want to prevent the public from making.

 

[wolluf]

Mandatory profiles? (Just rename the ntuser.dat file in the profile to ntuser.man. Any changes to the profile are then lost on logoff. You should also restrict their access to the all users profile to read only).

 

[DelphiAaron]

you can replace the desktop or shell with your own program.
edit the registry HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

change shell from explorer.exe to c:\myapp\myprog.exe

you can still ctrl/alt/del to bring up the task manager
so i suggest dissableing those keys in the software or hardware.


Aaron Taylor
John Mutch Electronics

http://www.jme.com.au

 

[mquinn0908]

I tried the gpedit.msc and when I change a policy there it affects any user that logs onto the machine not just the one I want. I want to be able to log on as an administrator and change whatever I want but changing policies through gpedit.msc then those changes also affect the administrator.

 

[wolluf]

so have you tried mandatory profile then?