Limit use of programs
Steve Hughes
How can I create an acount on my XP Pro machine and then limit acces to
certain things i.e. control panel, internet etc. I have tried creating a new
account but i just get choice of either Administrator or Limited, but no
further config options
Steve Hughes
users in GP Editor or do I log in as the person that needs limited account
and then run gpedit and set restictions?
"Jesper" wrote:
> Tell us more about what you want to do exactly? A limited user cannot install
> software or modify the OS itself. They can run programs, and see many of the
> control panels and change some.
>
> You can make further restrictions as to what they can see using group
> policy. Hold the Window key down, and hit R, and then type gpedit.msc in the
> resulting dialog. There are literally thousands of settings in there.
> Configuring them is a rather advanced operation though. Be careful, you can
> completely destroy your system using those settings.
Jesper
What are you trying to do? Keep in mind that many of the restrictions can be
circumvented by a determined attacker. In other words, if you are trying to
protect state secrets, we would need to have a longer chat.
Steve Hughes
exactly what I want to restrict access to, just want to stop the kids from
accessing certain apps, some control panel options and maybe even limit
internet connection time. I have had a little play with gpedit but everything
I changed seems to be system-wide, i.e. I logged on as a limited user - run
gpedit - and (can't remember where I did it now), but enabled a section that
limited certain windows applications from launching, I added iexplore.exe to
the list of apps that shouldn't launch. I then logged back onto my account
(which is in the admin group) and could'nt run Internet Explorer - so
obviously I need some more practice and advise
Nepatsfan
in message
news:4BED588D-E3CE-445F...@microsoft.com
Here are a couple of options I've seen suggested on these
newsgroups to deal with your issue.
Courtesy of Doug Knox, MS-MVP
Windows XP Security Console
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
Microsoft Shared Computer Toolkit
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx
Frequently Asked Questions About the Microsoft Shared Computer
Toolkit
http://www.microsoft.com/windowsxp/sharedaccess/faq.mspx
Good luck
Nepatsfan
Jesper
can put in run restrictions for certain programs as you tried. It's not like
you are trying to protect state secrets, so the limits you have here will
have reasonable effect. If your kid is at all inventive (and about 12 or
older; 8 if they are anything like one of mine) they'll figure out a way to
disable it though. I would really recommend you get one of the parental
control programs for this type of work. They can be circumvented too, but
they enable some additional controls, and make all of it a lot easier.
If you decide to do this manually, here are some hints. First, if you put
the restrictions in the "Computer Configuration" option they become
systemwide. You need to put them in the User Configuration to make them take
effect for only one user. That means, of course, that you need to log on as
that user to create the restrictions, and naturally that user can undo the
restrictions. From a security perspective, we consider these voluntary
restrictions. The user will only be restricted if s/he consents to be
restricted.
Second, much of what you want is under "User configuration:Administrative
templates:Windows Components:Windows Explorer," "User
configuration:Administrative templates:Control Panel," and "User
configuration:Administrative templates:System" settings." Particularly the
control panel restrictions and the "Do not run specified Windows
applications" settings are useful.
You cannot limit internet connection time with any built-in tools. You need
add-on tools for that, or a network with a real Windows server. Parental
control programs help there. Sorry, but I can't give you any recommendations
though. I don't use them personally. I have a full network at home, and use
the good old-fashioned eye-ball-on-child supervision method for anything
beyond that.
If you make the kid a limited user they will be pretty well restricted from
horking up the system without any additional modifications. That said, their
games probably won't run either. What I do is create a "games" account that
is allowed to play the games, but also has some group policy applied to it to
limit access to Internet Explorer. Those restrictions are of course
voluntary, as I mentioned earlier, but you can associate consequences to
violations to make them a bit more likely to be adhered to.
If you can wait a little while, Windows Vista has far better built-in
parental controls than Windows XP.
Carey Frisch [MVP]
http://www.microsoft.com/downloads/details.aspx?familyid=7256D456-E3DA-42EA-857D-92B716077A84&displaylang=en
--
Carey Frisch
Microsoft MVP
Windows Shell/User
Microsoft Community Newsgroups
news://msnews.microsoft.com/
---------------------------------------------------------------------------