Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

XP Pro Stop Local Administrators group been able to change Local Policy setting

Posted on 2004-08-05
11
Medium Priority
?
199 Views
Last Modified: 2013-12-04

Looking to create a system for home use with children, they need to be able to have Administrator level privs to install and run games etc, but they need to be denided to alter the other childrens personal (school) files.

can stop the Administrator Group getting access to files by stoopping Inhenentance and and also stopping the Administrator group being able to take ownership of objects using Local Policy.

but need to be able to Stop Administrators group being able to change local policy and give that ability to anotehr group or specific users, ie the parents.

Or the other soln would be to be able to create a new group that has almost every ability that the administrators group has.

I'm not interested in protecting the OS system, just each childrens and parent files from other users changing or deleting them.

0
Comment
Question by:JustInTime_au
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 11

Expert Comment

by:chad
ID: 11731990
There are not different levels of admin accounts for local machines.
Have you tried adding the kids as power users?  They should still be able to install any programs, printers, or device drivers.
Under control panel open admin tools... computer management...local users and groups....groups....power users
add the kids to the power users and remove them from the admin group.
0
 

Author Comment

by:JustInTime_au
ID: 11732210

Power Users are not sufficent to access all the thing like CR buners etc. not sufficen to install Gams without potential problems etc.
0
 
LVL 40

Expert Comment

by:Fatal_Exception
ID: 11732350
This would be easy if we were running a server here, eh?

I suppose what you could do is to place your children in the admin group, then go to each profile (Docs and Settings) and open the properties of each user (child).  On the security tab, take out the administrators group and only leave the user and System.  Now, there is a way around this, and knowing how smart young ones are nowadays, they may be able to take ownership, but this would require them to do some research...

FE
0
Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

 
LVL 11

Expert Comment

by:chad
ID: 11732387
using group policy, you could remove administrators from taking ownership of files or other objects.  But ensure that you add your user accounts BEFORE removing the admin group.
0
 

Author Comment

by:JustInTime_au
ID: 11732485

Yes, can remove the Administrators Group from being able to See into Folders owned by other.

Then you need to Stop the administrator being able to take Ownership so they cannot then change the Folder Permissions, done this using Group Policy, remove administrators group from 'take ownership' priv, make the parent group being able to take ownership.

But how to stop any Administrator Group being able to change Local Policy data, so giving back the ability of Administrators to take ownership and then getting access again to the other Childrens folders and files.

0
 
LVL 40

Accepted Solution

by:
Fatal_Exception earned 1000 total points
ID: 11732574
Thus the delimma, eh?  I guess that is what I was referring to in my comment above, that children today are inquisitive and knowledgeable with their computing skills...  I don't think there is a way to password protect the Security Policies...  Whatever you do as the admin, as long as your users have admin priveleges, then they will be able to circumvent it...  But I will think on it some more and perhaps another expert has some idea how to lock down the system..

FE
0
 
LVL 12

Assisted Solution

by:gidds99
gidds99 earned 1000 total points
ID: 11757840
If you are using Nero you can allow non admin users to burn CD's using this free tool:

http://www.nero.com/en/631940824944968.html

You should be able to make it very difficult (although not impossible) to change the local policy using a combination of file permissions and policies.   As you can create a restrictive policy and make it very difficult to get round:

http://is-it-true.org/nt/nt2000/atips/atips131.shtml

The above link describes how to exclude your own admin account from the policy.

I dont believe it is possible to achieve what you are trying to do.  The best you can do is make it very difficult for the Kids to get round the restrictions.

Hope this helps.

0
 
LVL 40

Expert Comment

by:Fatal_Exception
ID: 13956069
:)
0

Featured Post

Cyber Threats to Small Businesses (Part 2)

The evolving cybersecurity landscape presents SMBs with a host of new threats to their clients, their data, and their bottom line. In part 2 of this blog series, learn three quick processes Webroot’s CISO, Gary Hayslip, recommends to help small businesses beat modern threats.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
Our Group Policy work started with Small Business Server in 2000. Microsoft gave us an excellent OU and GPO model in subsequent SBS editions that utilized WMI filters, OU linking, and VBS scripts. These are some of experiences plus our spending a lo…
This Micro Tutorial will teach you how to add a cinematic look to any film or video out there. There are very few simple steps that you will follow to do so. This will be demonstrated using Adobe Premiere Pro CS6.
Please read the paragraph below before following the instructions in the video — there are important caveats in the paragraph that I did not mention in the video. If your PaperPort 12 or PaperPort 14 is failing to start, or crashing, or hanging, …

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question