[aerain]

Hello, All!

I need to lock down a machine for customer use and I decided to use the Group Policy Editor. Well, I found out that whatever I do to lock users down in GPEditor, it locks down my administrators account as well. I thought that it will only affect people who do not have admin priviliges but I was wrong! Here's my question:


How do I lock people down using the Group Policy Editor WITHOUT affecting the administrator's account or any other admin for that matter? Thanks!

 

[Squashman]

Try denying administrators read access to C:\WINDOWS\system32\GroupPolicy folder. I have been told by an MCSE that this works but have never tried it. But once you do this, you will not be able to run gpedit until you give the administrators read access again. So you will have to toggle permissions back and forth if you do alot of editing to the group policy files. This is about the only way you could do it on a standalone system. If you have 2000 or 2003 server you could then implement policies based on groups of users.