Link to home
Start Free TrialLog in
Avatar of smart Z
smart Z

asked on

Lockdown of laptops

Hi there,

I am looking for a guide to lockdown the laptops. Right now all the users have full rights to the C drive and it is windows 7 environment.

Thanks,
SOLUTION
Avatar of Joseph Moody
Joseph Moody
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
What is it specifically that you're trying to do?  Joseph's suggestion is a good one, but may not be inclusive enough if you're looking to really lock them down.  Of course you could lock them down so much that they can't do any work.
Avatar of Bradley Riedell
Bradley Riedell

I would also advise turning on UAC after removing local admin rights it will make it so that users cant just go installing whatever they would like.
Well are you stopping users from writing to C:/ drive so they don't lose documents if in the event of a hard drive crash ? What is your reasoning for locking it down ?
"full rights to the C drive" suggests that they are local admins. Standard ("restricted") users may only write to their own profile, but they may also create subfolders directly at the root of c: - the latter can be simply denied by modifying the ACL of c: itself. That should be done.
Avatar of smart Z

ASKER

Gents,

We are all just doing here a conversation and no actual way to do it is discussed.

Lets me make it easy to understand the question. I want the users to operate as power users and not as local admin on their laptops. I do not want to install applications on their own. That is what I want to achieve by GPO or through changes to the MMC console using groups.

Can anyone assist me?
If you create a gpo for uac and one to remove local admin rights they will not be able to install anything.
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of smart Z

ASKER

The user account are added to the local admin.

I want to make a change by moving the user account to power user group. Power User group was never deprecated as I am using windows 10 and I do see it under the local users and groups.

That is one that I will resolve now.

The other thing is GPO policy what do I actually need to do to remove UAC, By removing UAC - how is that helping with the restrictions? Please elaborate.

Thanks,
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial