Link to home
Start Free TrialLog in
Avatar of mercuriousu2
mercuriousu2

asked on

Removing Group Policy from user machines

We have our users tied down on their PC's to disallow certain functions, such as full access to the control panel and IE settings.
To enable quick access to remove permissions when troubleshooting the users profile, we use an application called "Killpol", this application user the domain administrator account to temporarily remove the Group policy on the PC.

I need to limit the access to the domain administrator account, so another user account was setup as a domain admin to use in conjunction  with the Killpol application.  Although the new account seems to work (no error), it does not actually remove the policy and only by using the domain administrator account will to work correctly to view the full contents of the control panel.

Maybe the application has something written to expect that account, but ideally any domain admin account should work.

Does anyone know of a quick way to remove a users policy without having to be working inside GPO?

Thanks in advance for any input on this.

User generated image
ASKER CERTIFIED SOLUTION
Avatar of Ed OConnor
Ed OConnor
Flag of Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of mercuriousu2
mercuriousu2

ASKER

Thanks for that, the only problem is not giving desktop support access to either GP or the domain/administrator account.  That application has been used for a long time, although it only seems to work with the administrator account.

Other administrator membership accounts look to work, but when checking the PC access to restricted areas it is apparent that it had not.  I am not too sure where additional permissions need to be set to ensure that the policy can be removed?

This needs to change, as many people ended up with access to those details by support staff not being diligent in hiding what was being typed into the application.

The application stopped being supported many years ago by the developer, it is safe enough in the correct hands although I need to be able to remove policies without giving out the full admin account details.

Thanks again
This was the solution given not using the application mentioned, that app also now works as the problem was the PC's UAC restricting the account  used from accessing the registry fully to where it needed to remove restrictions.  Moving UAC to a lower level enabled it to work the same as the full admin account.

Thanks for the assistance.