Solved How to prevent Guest account from making modifications to the computer

Hellllllo !

On my work laptop I have my Administrator account, which I use all the time, and a Guest account that people can use to go on the Internet etc.

What I have not found out how to do yet is to prevent the Guest account users from :

- Installing or removing software
- Changing any setting in control panel (or the shortcuts leading to it, such as "right-click on the Desktop > personalize"
- Changing internet connections (I've caught guests on the neighbor's open network often, even though my WPA2 wireless network is remembered)

What I have found how to do, using permissions:

- Open specific programs (I have gone and edited the permissions on all the .exes files for the programs I wanted to restrict, and it works fine)
- Access partitions or hard drives (Guests only see the path exists, they have no access and no info to the partitions/drives I restricted)

Now, about my problem, what I've tried so far:

- Same as I did to restrict access to partitions/hard drives, using permissions: I tried to modify the permissions of the Guest account to allow only reading and launching apps on C: as a whole. That didn't work though, Windows wouldn't let me change the permissions on the system disc, even as an administrator with UAC off. I tried many combinations of allow/deny and no change is permitted.

So, what can I do ? Right now, there are only a few shortcuts on the Guest account desktop, but I've tested it: using the Start menu or the command prompt a guest can access so many settings on the computer ! Modify Windows sounds, fonts and styles, uninstall or install programs, modify power plans or Windows update settings, etc etc... all Control Panel items it seems. In fact, I'm amazed at how the Guest account is NOT restricted! The only thing it can't do, without tweaking, is access other users' folders on C: I mean what the flip ?

What I have found so far to help me, and that doesn't solve my problem :

http://www.sevenforums.com/tutorials/77679-programs-features-enable-disable.html not good because it's for ALL users, including admins. I only want to restrict the Guest account.
How To Disable Control Panel in Windows 7 - How-To Geek same thing
Restrict Specific Users From Accessing Windows Control Panel would be good but applies to Vista and I have not found the equivalent for 7
Prevent users from accessing the Control Panel but allow Administrators would also be good but the software doesn't exit for 7.

Final note: It would be ideal if guests could update Java, Flash, Firefox etc. when they get prompted, but if the solution you give me prevents that, no problem. The most important is to prevent the Guest account any access to Control Panel items, especially Add or Remove Programs.

Thank you for your time !

A guest account DOESN'T have admin rights, just as a standard user. He/she cannot modify registry keys in HKLM so cannot modify system wide settings!

He can change his own font and his own windows sounds. But not install programs.

Partial oops

Hello Kaktussoft !

Sorry, I have checked and you're right, the control panel options that seem to be accessible to the Guest account are those regarding the accounts' preferences only (display, font, ease of access etc. etc.) and *not* Firewall, Backup & Restore, Administrative tools, etc. Maybe while testing I had inadvertently clicked "Run as Administrator" or something...

Still, the Power Plans, what the lid/power button does, when and if the computer sleeps, etc. are available for tinkering for instance. I'm wondering, what else? Wouldn't it be much simpler if Control Panel was simply denied to the Guest account ?

Also, when testing for the ability to install programs, I made the mistake of aborting during installation, because I had not realized that the inability to install programs manifested itself at the very end of the process. Download zipped installer, unzip, execute, installation begins, etc. but at the very end it says installation failed for lack of permission. Maybe it's because I tried with open-source programs (VLC and OpenOffice) which may be more aggressive in their installation process... I could try with something commercial. See the result here for OpenOffice

I was however able to uninstall programs, and that's a problem. See before and after but I haven't started uninstalling everything just to test things out. If you're curious I could try but I don't have much useless stuff installed... =)

But I'm willing to wait for someone to simply reveal the way to block access to any and all Control Panel items for a specific user, which would take care of everything. Including pranks: someone logged in the Guest account and changed the wallpaper to a very suggestive picture of Paul Walker, I don't know how long ago, and yesterday my mother wanted to use the computer... "son, what is this ?!?!" lol ! This is what prompted my investigation in fact.

Anyways, sorry about the mistakes and thanks a bunch Kaktussoft.

A guest user cannot write to c:\program files and c:\windows and more folders. In registry he cannot write to HKEY_LOCAL_MACHINE and more registry keys.

Check it yourself!!

But all changes to "user stuff" like background image will retain.

surprised

Kaktussoft said:

A guest user cannot write to c:\program files and c:\windows and more folders. In regsitry he cannot write to HKEY_LOCAL_MACHINE and more registry keys.

Click to expand...

I know ! That's why I'm surprised I was able to uninstall Synergy (you've seen the image) and VLC Player, while logged is as Guest user... But as I said, it's the only two I have tried uninstalling, and I couldn't install them back or anything else in fact, "no permission"

rename c:\users\guest\ntuser.dat to c:\users\guest\ntuser.man
Please test it. Then user settings are reverted to as it was.