Stop Local Group Policy Applying to the Local Machine Admin

[CM786]

Hi guys,

 

I have seen this somewhere but now I don't seem to be able to find it?

 

I am setting up some laptops (no domain controller) and I want to restrict the "students" account on them. I know that if I change the local group policy (gpedit.msc from Run) it will affect both the Admin account ("ITAdmin") and the student account. I only want the group policy to affect the student account. I read about a crude workaround to this ages ago.. but now cannot find it??

 

Thanks for any help.

CM786

[DMcCoy]

deny administrator access to the GroupPolicy Folder on the C: drive perhaps?

[bossman]

CM786: Hope this might help:

 

http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/xpsgch05.mspx

automated_scripts.doc

[CM786]

I didn't think this thread had been posted since IE6 crashed when I clicked on the Submit button.... glad it worked however!

 

Thanks for the link bossman, just checking it out now.

[CM786]

This looks useful and I think what DMcCoy as getting at:

 

http://www.theeldergeek.com/gp07.htm

[CM786]

Just to update.

 

In the end I used:

 

http://www.petri.co.il/killpol.htm

 

Killpol - This tool enables you to temporarily remove policy restriction for the current user.

 

Works for me!

[polaqw]

Hi, i am a technical constultant specalising in Terminal Services, XP Embedded and automated Desktop deployment.

 

We at my company have managed to solve this issue for Local GP inheritance. THe next post will tell you how!

[polaqw]

We had to work out how to do this for our XPe Devices. It took my collegue a long time to work out the way to solve this issue, but Jean Marc managed in the end.

 

We have decided to write it down on my blog, so please see

 

How to stop an Admin account getting Local GP settings | Simon Todd's Free Technical Blog!

 

The post tells you which keys to change to stop local GP settings being forced on a local admin

 

Thanks