I run an Internet cafe where I would like to offer 2 different types
of user logins. One would be a basic user that has only access to
Internet Explorer (no priniting, no word processing, no winzi, no msn,
nothing) and the other would be a premium user that can accesss all
the applications (except administration tools). I would like to have
some sort of batch file or some other solution where I can log them on
and off from the reception with either basic user or premium user
privileges. I have already worked out how to block the applications &
how to restrict the basic user but my problem is remotely passing the
user login parameters to the windows 2000 machine. Please help!!! If
there is an existing software that can do this, please let me know.

---

Clarification of Question by princysingh-ga on 23 Oct 2005 20:46 PDT

I am not to worried about the permission settings ... That I can
change by editing registry keys for the applications that I would like
to Block... My main concern is sending 2 seperate User Login info to
each machine when I want to log them. I realise I can use VNC but I
dont want to click & type in user password each time on each machine
... It is very time consuming... I would ideally like 2 batch files
for Basic user and Premium user that I can just run remotely and will
send the login info there and login the pc

I have not performed what you are looking to do, but I think you would
have good results following one of the two routes I suggest:

1. Replace the Windows GINA.
The GINA is the authentication mechanism that grants a particular user
access to the Windows system.  By replacing the GINA with an
off-the-shelf product or creating your own, you would be able to build
remote access authentication.  A starting point would be to test out a
free replacement available at http://pgina.xpasystems.com.

2. Use a remote administration tool.
There are several packages that are similar to Remote Desktop which
would grant a remote user access as if they were at that terminal. 
Now, I've never used Remote Desktop (built in to Windows XP) but I
think it prevents someone from using the terminal when a user is
logged in remotely.  That contravenes your requirements.  Other
software such as Remote Administrator (commercial) or VNC (free) can
give you the access you're looking for.  You would be the one to log
the user in and then you could disconnect the session.  Investigate
Remote Administrator at http://www.famatech.com/ or VNC at
http://www.realvnc.com/.  Note there are other versions of VNC.  A
Google search will give you a long list of alternatives.

Setting up a domain would easily satisfy your requirements. You can
make all the changes on the domain controller to get the users in the
groups you want and base the permissions level on groups on the local
computer. Each computer would authenticate users against the domain
and enable your permissions.

If you don't have the resources (or expensive 'Server') license to set
up a domain here's what you can do.

1. Go to www.sysinternals.com and download the free psexec utility.
2. Set up your groups with permissions on the individual computers.
3. Use net user and net localgroup to manage the individual computers.

for example:

from the counter computer type or batch file:
psexec \\remotecomputername c:\winnt\system32\net user SillyCustomer /add
psexec \\remotecomputername c:\winnt\system32\net localgroup
Administrators SillyCustomer /add

As far as logging on for them goes you could simply install UltraVNC
or TightVNC remote control software on the computers.