This is sort of a branch from a previous post to do with protection a computer that will have public access.
One of the suggestions was to use the Group Policy Editor. I am somewhat inexperienced here and one thing I am not understanding; How do I make the changes (restrictions) apply to just one user (Guest) or a guest-like user and not the Administrator?
Any help is gratefully appreciated.
What exactly are you trying to restrict? Program acess? Drive access? Applet access, as in certain areas of Contol Panel or even Control Panel as a whole.
I had a question similar to this not too long ago, but I specifically wanted limited drive access. If that is what you're looking for too, you would restrict the access by way of the drive itself.
Example: Go to Computer, right click the drive you want to edit, click Properties, click the Security Tab, click the Edit button, click the Add button, enter the User Name in the box and click Check Names, then OK. Then you would check Deny for whatever property of the drive that you want that User denied access to. Click Apply, then OK, then you're done.
Reply back with what you're looking to do.
BTW, Group Policy Editor is not included in the Home versions of Windows 7
I am trying to lock down computers for public access. Things like - no programs copied or executed from USB drive or CD or DVD, no deleting software, no downloading drivers or programs, etc, etc.
I'm not the professional using GPE, but I have used it a little. I would believe that you would go to User Configuration > Administrative Templates and either System or Windows Components.
With the few things I have used GPE for, I found where I needed to go by Google or by tediously clicking through (almost) every entry within System or Windows Components to find what I needed.
Hopefully someone else more knowledgeable than I can get you where you need to be in fewer steps.
I agree, with flexibility comes a lot of options.
I only have to figure it out once and I can move it to all the machines I am setting up.
The part I am unable to understand, how do I make the policy changes apply to one user , i.e. Guest?
That was my problem, but as I stated in my first reply, it was solved by way of the drive properties (because that is what I wanted restricted access to.)
But in thinking over what you just stated, would the Parental Controls work for you? With Parental Controls, you do have a way to restrict program access to a single user, as well as setting up time limits, etc., all while having the user's logged in time saved to a log for you to monitor.
Win7 has a feature called "Guest Mode" (different from guest account!) that prevents system setting changes, prevents installation of apps, prevents the user from writing to the disk outside of their profile and cleans up any changes made once the user logs off. You can explore all its features and determine whether it is suits you by going through this page.
http://www.winsupersite.com/win7/ff_pcsafeguard.asp
Otherwise, as pointed out, you can use the group policy editor to impose various restrictions. There are numerous things that can be done but E.g. to prevent installation of apps, you can disable the windows installer which is required for the installation and removal of software
Type gpedit.msc in Start search and hit Enter to open the Group Policy Editor. Navigate to Computer Configurations > Administrative templates > Windows Components > Windows Installer. In RHS pane double-click on Disable windows installer.
I think we are providing more complicated answers than necessary.
Starting with Vista, you can now create multiple local group policies.
Taking advantage of Windows Vista's Multiple Local Group Policy feature | Microsoft Windows | TechRepublic.com
Simply fire up Group Policy Object Editor and follow the instructions. For us Server 2000/2003 veterans, the Group Policy Object Editor will look awful familiar.
This is the easy way to edit local group policies for groups of non administrators on Windows 7 pro running without a domain controller:
1. Open the Microsoft management Consol (Type mmc in search box)
2. On the menu bar select File / Add or Remove Snap in
3. Select 'Group Policy Object' / Add / Browse / non-Administrators
4. Set policies that will effect all non-Administraors
5. Save console for next time
Exit
Works for me !
Quote