restricting user access on a workgroup

[philbert_mcpleb]

one of my schools has just bought a couple of laptops running vista, they have the users set up but the pupil user needs to be restricted so that they cannot install software and similar, teh only options available are standard user and administrator. from what i've seen these options seem to have little difference in what you can and cannot do

if anyone can shed some light on how to restrict the user further that would be a great help

cheers

[FN-GM]

There is not much really you can do with standard windows on a workgroup. You will have to use 3rd party software.

[kmount]

I'm inclined to disagree a little.

I'm unfortunately on a vista machine on a workgroup at the moment and having had a few minutes nosing around in the mmc group policy editor I can see means to lock it down a fair bit.

Not an ideal situation by any stretch of the imagination but some schools rely solely on workgroups and don't have third party software to help them out so its doable.

I guess there's no domain at your location?

[FN-GM]

I know but doing that will also lockdown the administrator account.

[philbert_mcpleb]

i wish there was a domain

[Quackers]

There is a tool just made for you out there and its free from Microsoft

http://www.microsoft.com/windows/pro...s/default.mspx

Its just finished the 2.5 Beta, so 2.5 should be for download as final any day now, so hold off until then, but you can lock down settings on a per user basis on a standlone, workgroup enviroment, disk protect, very handy tool.

[flashsnaps]

Don't really know that much about it - but have read over the subject.

Not sure about Vista as I don't have a machine to check. But on XP

Run > gpedit.msc

Allows you to enable/disable functions

[FN-GM]

Don't really know that much about it - but have read over the subject.

Not sure about Vista as I don't have a machine to check. But on XP

Run > gpedit.msc

Allows you to enable/disable functions

But any polices you set in here will also apply to the administrator account, thus locking the administrator out of certain things.

[acrobson]

Yeah, just add a short cut to GPEdit on the admin desktop, once clicked on select to disable the security restrictions, tick the boxes. Simple. The admin will only use the account when making major changes etc. Not much of a big deal really.

[FN-GM]

Suppose that will work, good point.

[acrobson]

I know it works; I have been in a similar predicament myself.

[philbert_mcpleb]

i'll probably go for the tool from MS, but the local policy is an option. i'll let you know how i get on.

thanks