Need Help Restricting Users On Winxp

[szwicker]

I'm trying to find ways to restrict certain users (local to the machine, not on a domain so no GP) to the point where all they can do is run certain applications I place on their desktop. Other than that, they can't evne go through the START MENU or run windows.exe.

Any ideas: Tweaks, reg hacks, alternate shells, etc?

Thanks in advance.

[firefoxthebomb]

you could try a program called 1st Security Agent you can find it On This Web Site

[D.Celt]

You can create limited user accounts & set a local group policy.

[neil]

from the same website that firefoxthebomb suggested:

Public PC Desktop

This turns your PC into an internet kiosk-like desktop. Not quite as extreme as 1st Security Agent but its $10 cheaper, and will still limit the user to accessing only what you allow them.

[Looneyboy784]

do what schhools around the country do to turn pcs into paperweights. install foolproof, fortress 101, or others. this can be circumvented but it reqiers effort.

[Ghostrider]

do what schhools around the country do to turn pcs into paperweights. install foolproof, fortress 101, or others. this can be circumvented but it reqiers effort.

<{POST_SNAPBACK}>

I agree, i use this to install in library's and once you are happy with the settings you can export them and import on a new install, cutting down time on new computer installs. get at http://www.fortres.com/

[DigeratiPrime]

Alot can be done from the Group Policy Editor (Start>Run>gpedit.msc).

Remove Start Button: LClock can do this.

Remove Taskbar:

Lock Desktop Icons:

Disable TaskManager:

Add or Remove Programs Restrictions

Prevent Access to the Contents of Selected Drives

Hide Drives in My Computer

Disable Registry Editing Tools

Restrict Applications Users Can Run

Disable the Windows Key

Disable Menu Bars and the Start Button

Remove the Ability to Right Click on the Start Button

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]

;Remove Tray Items from Taskbar
;This setting removes and restricts access to the tray icons normally found next to the clock on the taskbar.
"NoTrayItemsDisplay"=dword:00000001

;Remove File Menu from Explorer
;This setting is used to Remove the File option from the Explorers toolbar.
"NoFileMenu"=dword:00000001

;Disable Control Panel
;This setting allows you to restrict user access to the Control Panel options and settings.
"NoControlPanel"=dword:00000001

;Disable the Windows Hotkeys
;This restriction allows you to disable the use of the Windows hotkey combinations that provide shortcuts to the Start Menu and task swapping.
"NoWinKeys"=dword:00000001

;Disable the Ability to Right Click on Desktop and in Windows Explorer.
;This tweak removes the context menu that would normally appear when the user right clicks on the desktop or in the Explorer right results pane.
"NoViewContextMenu"=dword:00000001

;Disable Drag-and-Drop on the Start Menu
;This restriction prevents users from modifying the Start menu by dragging and dropping items.
"NoChangeStartMenu"=dword:00000001

;Remove Run from the Start Menu
;Removes the ability to launch commands or processes from the Start menu by removing the Run option.
"NoRun"=dword:00000001

;Remove the Toolbars on the Taskbar
;This restriction is used to remove all the toolbars, including Quick Launch, from the taskbar. It also restricts the ability to re-enable them.
"NoToolbarsOnTaskbar"=dword:00000001

;Hide the Taskbar Clock
;This setting allows you to remove the clock from the system tray on the taskbar.
"HideClock"=dword:00000001

;Remove Shared Documents from My Computer
;The Shared Documents folder allows users to easily share files and folders over a network. This restriction will remove the "Shared Documents" object from My Computer.
"NoSharedDocuments"=dword:00000001

;Disable CD Burning
;This restriction is used to disable the use of the inbuilt CD recording functions of Windows.
"NoCDBurning"=dword:00000001

"NoDesktopCleanupWizard"=dword:00000001
"NoRemoteRecursiveEvents"=dword:00000001

Edited April 4, 2005 by DigeratiPrime

[ripken204]

definently go w/ 1st Security Agent

[Acheron]

You can create limited user accounts. However to use some programs you need to set directory acces to read/write enabled.

For example I use the following command during unattended installation:

cacls "%programfiles%\Shareaza" /E /T /P Users:C

Users is here the name of the limited users group.

[betamax]

sorry to bump an old thread, but I was just wondering if gpedit.msc was available in xp home

[Idontwantspam]

sorry to bump an old thread, but I was just wondering if gpedit.msc was available in xp home

No, it's not. But you can still edit most policies through the registry editor. I've tried it on an XP home computer. Some parent got ticked off at their kid for always locking the computer as they didn't know his password or have any clue how to unlock it. Now that user can't lock the computer, thanks to

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System!DisableLockWorkstation

Edited April 7, 2007 by Idontwantspam