locking down specific user in Win XP

[swpmre]

Hi all,

 

Perhaps I am not using the correct words when I google this, but I can't find an answer, so I'll try here!

 

I'm trying to lock down a particular user on some Windows XP machines. We don't use Active Directory, so I can't do a Group Policy.

 

I would like (for instance) to restrict access to various programmes, control panel etc, but only on one user account. I'd like all the others to remain the same.

 

I've tried using gpedit.msc, but Group Policy Editor changes the settings for all users on the PC.

 

Any other ideas?

 

Martin

[burgemaster]

Stab in the dark,

 

You could create a login scipt that make the changes to the registry?

It would look at the login name and only apply changes if XXXX is logging in.

Probably an easier way to do this

Good luck!

[dtakias]

Hi there

 

Are you using network logons?

 

You could open up registry, navigate to hkey users, then load hive and open the ntuser.dat of the account you want to lock down. Lock the profile as you wish using registry settings and unload hive.

 

Then move the profile over to your domain controller and link it to the user you want to lock it's access down.

 

Ta

Nick

[swpmre]

Hi, no we're not using network logons. This is just a local profile.

[dtakias]

Then you could just copy the profiles on the other machines or use a logon script as suggested by burgemaster.

[swpmre]

Apologies, but I don't understand what you mean by "copy the profiles on the other machines". We don't have this working for any user / logon yet, so I can't copy those profiles :-(

[dtakias]

Apologies, but I don't understand what you mean by "copy the profiles on the other machines". We don't have this working for any user / logon yet, so I can't copy those profiles :-(

 

Sorry I meant once the profiles have been configured.

 

Example of lock down registry settings can be found here.

 

We have a number of laptops that we use for conferences and special events. I found locking down the registry this way for different profiles works quite well.

[Michael]

If you use gpedit.msc locally then yes this will lock down all users. By setting other users as 'Users' or 'Limited user' will prevent users playing with more critical Control Panel components.

 

Other than this Windows Server is your only realistic chance of doing things properly!

[RSoP_Robbers]

Hi swpmre

 

What sort of scenario do you want to achieve?

 

Do you have a number of laptops for example that you wish to place in a library and use the welcome screen to display a student logon etc?