Stand-alone policies for XP

[Vitalix]

I have a need to secure a single XP PC so that the 'administrator' can do anything but the 'user' can only run 2 programs and have limited access to the PC.

In NT I'd use a policy but I can't find it in XP. I have tried the software control but it doesent stop system commands (change desktop/screensaver/other stuff that users do to mod/break their PC's).

The main lock I want to use is the 'Allow certain apps for users' but permit the admin to have carte-blanche.

Any ideas?

Thanks in advance!

[Chocolatemilk]

Start > Run >

and type GPEDIT.msc

you can lock out certain user classes here.

Also you can remove the default group users ability to go outside of any folders you consider as necessary.

[Vitalix]

Start > Run >

and type GPEDIT.msc

you can lock out certain user classes here.

Also you can remove the default group users ability to go outside of any folders you consider as necessary.

That's the thing, when going in there, any changes made to user enviro affects the administrator as well. There is KB article in MS on how to make a backup copy for the pol file, then logon as user, then go back as admin and copy over the policy with the backup, so that the options do not apply to admin, but that does not work if I want the original policy to not invoke control panel (or any msc or mmc snaps). In NT, we used to do this, but in XP there is no such separation.

There's gotta be a way to do this, but no luck yet...