XP Pro Stop Local Administrators group been able to change Local Policy setting

Posted on 2004-08-05
Last Modified: 2013-12-04

Looking to create a system for home use with children, they need to be able to have Administrator level privs to install and run games etc, but they need to be denided to alter the other childrens personal (school) files.

can stop the Administrator Group getting access to files by stoopping Inhenentance and and also stopping the Administrator group being able to take ownership of objects using Local Policy.

but need to be able to Stop Administrators group being able to change local policy and give that ability to anotehr group or specific users, ie the parents.

Or the other soln would be to be able to create a new group that has almost every ability that the administrators group has.

I'm not interested in protecting the OS system, just each childrens and parent files from other users changing or deleting them.

Question by:JustInTime_au
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +1
LVL 11

Expert Comment

ID: 11731990
There are not different levels of admin accounts for local machines.
Have you tried adding the kids as power users?  They should still be able to install any programs, printers, or device drivers.
Under control panel open admin tools... computer management...local users and groups....groups....power users
add the kids to the power users and remove them from the admin group.

Author Comment

ID: 11732210

Power Users are not sufficent to access all the thing like CR buners etc. not sufficen to install Gams without potential problems etc.
LVL 40

Expert Comment

ID: 11732350
This would be easy if we were running a server here, eh?

I suppose what you could do is to place your children in the admin group, then go to each profile (Docs and Settings) and open the properties of each user (child).  On the security tab, take out the administrators group and only leave the user and System.  Now, there is a way around this, and knowing how smart young ones are nowadays, they may be able to take ownership, but this would require them to do some research...

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 11

Expert Comment

ID: 11732387
using group policy, you could remove administrators from taking ownership of files or other objects.  But ensure that you add your user accounts BEFORE removing the admin group.

Author Comment

ID: 11732485

Yes, can remove the Administrators Group from being able to See into Folders owned by other.

Then you need to Stop the administrator being able to take Ownership so they cannot then change the Folder Permissions, done this using Group Policy, remove administrators group from 'take ownership' priv, make the parent group being able to take ownership.

But how to stop any Administrator Group being able to change Local Policy data, so giving back the ability of Administrators to take ownership and then getting access again to the other Childrens folders and files.

LVL 40

Accepted Solution

Fatal_Exception earned 250 total points
ID: 11732574
Thus the delimma, eh?  I guess that is what I was referring to in my comment above, that children today are inquisitive and knowledgeable with their computing skills...  I don't think there is a way to password protect the Security Policies...  Whatever you do as the admin, as long as your users have admin priveleges, then they will be able to circumvent it...  But I will think on it some more and perhaps another expert has some idea how to lock down the system..

LVL 12

Assisted Solution

gidds99 earned 250 total points
ID: 11757840
If you are using Nero you can allow non admin users to burn CD's using this free tool:

You should be able to make it very difficult (although not impossible) to change the local policy using a combination of file permissions and policies.   As you can create a restrictive policy and make it very difficult to get round:

The above link describes how to exclude your own admin account from the policy.

I dont believe it is possible to achieve what you are trying to do.  The best you can do is make it very difficult for the Kids to get round the restrictions.

Hope this helps.

LVL 40

Expert Comment

ID: 13956069

Featured Post

[Webinar] How Hackers Steal Your Credentials

Do You Know How Hackers Steal Your Credentials? Join us and Skyport Systems to learn how hackers steal your credentials and why Active Directory must be secure to stop them. Thursday, July 13, 2017 10:00 A.M. PDT

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
Users of Windows 10 Professional can disable automatic reboots using the policy editor. This tool is not included in the Windows home edition. But don't worry! Follow the instructions below to install (a Win7) policy editor on your Windows 10 Home e…
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question