Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


XP Pro Stop Local Administrators group been able to change Local Policy setting

Posted on 2004-08-05
Medium Priority
Last Modified: 2013-12-04

Looking to create a system for home use with children, they need to be able to have Administrator level privs to install and run games etc, but they need to be denided to alter the other childrens personal (school) files.

can stop the Administrator Group getting access to files by stoopping Inhenentance and and also stopping the Administrator group being able to take ownership of objects using Local Policy.

but need to be able to Stop Administrators group being able to change local policy and give that ability to anotehr group or specific users, ie the parents.

Or the other soln would be to be able to create a new group that has almost every ability that the administrators group has.

I'm not interested in protecting the OS system, just each childrens and parent files from other users changing or deleting them.

Question by:JustInTime_au
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +1
LVL 11

Expert Comment

ID: 11731990
There are not different levels of admin accounts for local machines.
Have you tried adding the kids as power users?  They should still be able to install any programs, printers, or device drivers.
Under control panel open admin tools... computer management...local users and groups....groups....power users
add the kids to the power users and remove them from the admin group.

Author Comment

ID: 11732210

Power Users are not sufficent to access all the thing like CR buners etc. not sufficen to install Gams without potential problems etc.
LVL 40

Expert Comment

ID: 11732350
This would be easy if we were running a server here, eh?

I suppose what you could do is to place your children in the admin group, then go to each profile (Docs and Settings) and open the properties of each user (child).  On the security tab, take out the administrators group and only leave the user and System.  Now, there is a way around this, and knowing how smart young ones are nowadays, they may be able to take ownership, but this would require them to do some research...

Cyber Threats to Small Businesses (Part 1)

This past May, Webroot surveyed more than 600 IT decision-makers at medium-sized companies to see how these small businesses perceived new threats facing their organizations.  Read what Webroot CISO, Gary Hayslip, has to say about the survey in part 1 of this 2-part blog series.

LVL 11

Expert Comment

ID: 11732387
using group policy, you could remove administrators from taking ownership of files or other objects.  But ensure that you add your user accounts BEFORE removing the admin group.

Author Comment

ID: 11732485

Yes, can remove the Administrators Group from being able to See into Folders owned by other.

Then you need to Stop the administrator being able to take Ownership so they cannot then change the Folder Permissions, done this using Group Policy, remove administrators group from 'take ownership' priv, make the parent group being able to take ownership.

But how to stop any Administrator Group being able to change Local Policy data, so giving back the ability of Administrators to take ownership and then getting access again to the other Childrens folders and files.

LVL 40

Accepted Solution

Fatal_Exception earned 1000 total points
ID: 11732574
Thus the delimma, eh?  I guess that is what I was referring to in my comment above, that children today are inquisitive and knowledgeable with their computing skills...  I don't think there is a way to password protect the Security Policies...  Whatever you do as the admin, as long as your users have admin priveleges, then they will be able to circumvent it...  But I will think on it some more and perhaps another expert has some idea how to lock down the system..

LVL 12

Assisted Solution

gidds99 earned 1000 total points
ID: 11757840
If you are using Nero you can allow non admin users to burn CD's using this free tool:

You should be able to make it very difficult (although not impossible) to change the local policy using a combination of file permissions and policies.   As you can create a restrictive policy and make it very difficult to get round:

The above link describes how to exclude your own admin account from the policy.

I dont believe it is possible to achieve what you are trying to do.  The best you can do is make it very difficult for the Kids to get round the restrictions.

Hope this helps.

LVL 40

Expert Comment

ID: 13956069

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This is a guide to the following problem (not exclusive but here) on Windows: Users need our support and we supporters often use global administrative accounts to do this. Using these accounts safely is a real challenge. Any admin who takes se…
Article by: btan
The intent is not to repeat what many has know about Ransomware but more to join its dots of what is it, who are the victims, why it exists, when and how we respond on infection. Lastly, sum up in a glance to share such information with more to help…
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
Suggested Courses

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question