Researcher,

How do I severly restrict a local user account on my Windows XP box?

The Windows XP policy editor (Start => Run => "gpedit.msc") has a ton
of settings for customization (such as whats on the start menu,
limiting profile size, and a bunch of stuff that can't be accessed
through normal Windows settings). These are the types of settings I
want to restrict, but the settings changed in this editor (under
Administrative templates) are system wide.

I would like to be able to have these settings (in the group policy
editor) changed for a particular user. For example (not limited to),
the user has nothing on the start button but "programs" and "logoff",
the user can only run specific programs, the user cannot change any
settings in programs / Windows, etc.

Also, an addition to this question is: when I restrict a bunch of
files to the user (namly all file but 1 temp directory) the user gets
error messages when trying to run specific programs like Microsoft
Word (something about access to files).

QUESTIONS

1. How to apply group policy options found in the group policy editor
to a specific user
2. How to allow the user to run specific programs I allow without error
3. How to properly restrict file access to that user while maintaining
their being able to run specific programs

Note: Registry hacks and strange work arounds not accepted. But please
keep me informed if you have an idea.

This is done with a combination of:

lusrmgr.msc

others:

rsop.msc
secpol.msc

and editing ../Documents and Settings/All Users
and Default User

There are many settings (as you can see just from gpedit.msc) let
alone the other security settings. I assume your using XP Pro?

But you might be able to get away with just editing Docs & Settings.

In short use lusrmgr.msc and create a user named "child" and assign it
(double click) <tab> Member Of "Guests" and have them log as the user
"child". Read the description of the group "Guests" that may surfice
for what you want to do?


X

www.nwnzone.com

I used the lusrmgr.msc rsop.msc and secpol.msc snappins, and deleted
my administrator account.  Actually, i didn't delete it, I theink I
just revoked its local login privlages.  Now I have to use the guest
account, which is worthless when it comes to accessing anything. DO
NOT use these unless you are SURE you know what you are doing.  I
thought I knew what I was doing, but now I have to re-install XP.

:(