GPO with XP

[consoleone2000]

Hello,

I'm a admin of a network with 60 user's, and i have a big problem with my local group policy on Windows XP. I create a local GPO on each XP computer but the user's are able to modify and erase the GPO.

I thought that it was necessary to have the Administrateur right to be able to reach it, but with the right of user but all the users are able to reach it to change the restrictions.

I need a solution !!!

Thanks for your help !!!

[SiMoNsAyS]

they have an administrator account?? why don't you restrict their accounts to guest accounts?? that's only an idea, i don't know many more about networks

[jdoe]

If your 60 users mean 60 computers then you should really think about having a windows server domain. When you set group policy on a domain it can't be changed by local client users. Also you have the advantage to have a central configuration point - you don't need to set gpo on each computers anymore.

You can configure policy for specific groups or users.

Saving times...

More security...

[consoleone2000]

I have a network on Novell 5.1 not Windows Server, is the reason for create GPO on each computer.

Novell and Microsoft is a though job to administrate a network.

Chris

[consoleone2000]

OK, I found an alternative has my problem but I would like if you to find to another made me the knowledge of it.

I explain you what I found if that arrives to you one day:

You have just to remove the right of the user in the properties of the file "MMC" which this locates in Windows\system32.

The user which has only one right user will not be able to reach any more has the console "MMC" and with option "GPEDIT.MSC".

Chris

[jdoe]

I have tried to test that on my XP Pro but when I set a GPO the members of Users group cannot open gpedit.msc to change anything.

Make sure your users are really in the Users group and not in the Power Users group. If your users are in the right group then keep using settings right on mmc.exe if it work.