Solved

XP Pro Stop Local Administrators group been able to change Local Policy setting

Posted on 2004-08-05
11
188 Views
Last Modified: 2013-12-04

Looking to create a system for home use with children, they need to be able to have Administrator level privs to install and run games etc, but they need to be denided to alter the other childrens personal (school) files.

can stop the Administrator Group getting access to files by stoopping Inhenentance and and also stopping the Administrator group being able to take ownership of objects using Local Policy.

but need to be able to Stop Administrators group being able to change local policy and give that ability to anotehr group or specific users, ie the parents.

Or the other soln would be to be able to create a new group that has almost every ability that the administrators group has.

I'm not interested in protecting the OS system, just each childrens and parent files from other users changing or deleting them.

0
Comment
Question by:JustInTime_au
  • 3
  • 2
  • 2
  • +1
11 Comments
 
LVL 11

Expert Comment

by:kabaam
Comment Utility
There are not different levels of admin accounts for local machines.
Have you tried adding the kids as power users?  They should still be able to install any programs, printers, or device drivers.
Under control panel open admin tools... computer management...local users and groups....groups....power users
add the kids to the power users and remove them from the admin group.
0
 

Author Comment

by:JustInTime_au
Comment Utility

Power Users are not sufficent to access all the thing like CR buners etc. not sufficen to install Gams without potential problems etc.
0
 
LVL 40

Expert Comment

by:Fatal_Exception
Comment Utility
This would be easy if we were running a server here, eh?

I suppose what you could do is to place your children in the admin group, then go to each profile (Docs and Settings) and open the properties of each user (child).  On the security tab, take out the administrators group and only leave the user and System.  Now, there is a way around this, and knowing how smart young ones are nowadays, they may be able to take ownership, but this would require them to do some research...

FE
0
 
LVL 11

Expert Comment

by:kabaam
Comment Utility
using group policy, you could remove administrators from taking ownership of files or other objects.  But ensure that you add your user accounts BEFORE removing the admin group.
0
Complete Microsoft Windows PC® & Mac Backup

Backup and recovery solutions to protect all your PCs & Mac– on-premises or in remote locations. Acronis backs up entire PC or Mac with patented reliable disk imaging technology and you will be able to restore workstations to a new, dissimilar hardware in minutes.

 

Author Comment

by:JustInTime_au
Comment Utility

Yes, can remove the Administrators Group from being able to See into Folders owned by other.

Then you need to Stop the administrator being able to take Ownership so they cannot then change the Folder Permissions, done this using Group Policy, remove administrators group from 'take ownership' priv, make the parent group being able to take ownership.

But how to stop any Administrator Group being able to change Local Policy data, so giving back the ability of Administrators to take ownership and then getting access again to the other Childrens folders and files.

0
 
LVL 40

Accepted Solution

by:
Fatal_Exception earned 250 total points
Comment Utility
Thus the delimma, eh?  I guess that is what I was referring to in my comment above, that children today are inquisitive and knowledgeable with their computing skills...  I don't think there is a way to password protect the Security Policies...  Whatever you do as the admin, as long as your users have admin priveleges, then they will be able to circumvent it...  But I will think on it some more and perhaps another expert has some idea how to lock down the system..

FE
0
 
LVL 12

Assisted Solution

by:gidds99
gidds99 earned 250 total points
Comment Utility
If you are using Nero you can allow non admin users to burn CD's using this free tool:

http://www.nero.com/en/631940824944968.html

You should be able to make it very difficult (although not impossible) to change the local policy using a combination of file permissions and policies.   As you can create a restrictive policy and make it very difficult to get round:

http://is-it-true.org/nt/nt2000/atips/atips131.shtml

The above link describes how to exclude your own admin account from the policy.

I dont believe it is possible to achieve what you are trying to do.  The best you can do is make it very difficult for the Kids to get round the restrictions.

Hope this helps.

0
 
LVL 40

Expert Comment

by:Fatal_Exception
Comment Utility
:)
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

As I write this article, I am finishing cleanup from the Qakbot virus variant found in the wild on April 18, 2011.  It was a messy beast that had varying levels of infection, speculated as being dependent on how long it resided on the infected syste…
Recently, I read that Microsoft has analysed statistics for their security intelligence report. It revealed: still, the clear majority of windows users do their daily work as administrator. An administrative account is a burden, security-wise. My ar…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now