Local Group Policies - Apply to All Users Except Administrators

How to Apply Local Group Policies to All Users Except Administrators​

   Information

This tutorial will show you how to apply Local Group Policies to all users except administrators in Vista, Windows 7, Windows 8, and Windows 10.

You must be logged in as an administrator to be able to do this tutorial.

   Warning

The Local Group Policy Editor is only available in:

• Vista Business, Ultimate, and Enterprise editions.
• Windows 7 Professional, Ultimate, and Enterprise editions
• Windows 8/8.1 Pro and Enterprise editions.
• Windows 10 Pro and Enterprise editions.

Here's How:
1. Open the Start Menu, type mmc.exe in the search box, and press Enter.
NOTE: In Windows 8, you could press Windows+R keys to open the Run dialog, then type mmc.exe, and click/tap on OK instead.

2. If prompted by UAC, then click on Yes (Windows 7/8/10) or Continue (Vista).

3. In the MMC Console window, click on File (Menu bar) and Add/Remove Snap-in. (see screenshot below)

4. In the left pane, select Group Policy Object Editor, and click on the Add button. (see screenshot below)

5. Click on the Browse button. (see screenshot below)

6. Click on the Users tab, select an Non-Administrators, and click on OK. (see screenshot below)

7. Click on the Finish button. (see screenshot below)

8. Click on OK. (see screenshot below)

9. In the MMC Console window, click on File (Menu bar) and Save As. (see screenshot below)

10. Select to save to your Desktop, type in a name (ex: Non-Administrators-Group-Policy) that you would like to have for this "all users except administrators" group policy MSC file, then click on the Save button. (see screenshot below)
NOTE: You can use any name you like, but it would make it easier for you to know what user (ex: Test) or group this "specific" group policy MMC console was for later if you included the user or group name.

11. Move the MSC file (ex: Non-Administrators-Group-Policy.msc) to where you would to keep it saved at. (see screenshot below)
NOTE: You can also Pin to Taskbar or Pin to Start Menu this MSC file.

12. Whenever you open this MSC file (ex: Non-Administrators-Group-Policy.msc), it will only apply group policies to all users except administrators. (see screenshot below)

That's it,
Shawn

Related Tutorials

---

• How to Add Local Group Policy Editor to the Control Panel in Windows
• How to Open the Local Group Policy Editor in Windows
• How to Apply Local Group Policies to a Specific User or Group in Vista, Windows 7, and Windows 8
• How to Back Up and Restore Local Group Policy in Windows
• How to Reset Local Group Policy to Default in Vista, Windows 7, and Windows 8
• How to Quickly View Enabled Group Policies in Windows
• How to Force Group Policy Updates to be Applied Instantly in Windows

 

[pallipe]

Confused about permanence of policy

Hi,
Thanks for the step-by-step, but I am a little confused by step #12:
Whenever you open this MSC file (ex: Non-Administrators-Group-Policy.msc), it will only apply group policies to all users except administrators. (see screenshot below)

I want the Group Policy I created to ALWAYS apply to limited user accounts automatically. How do I make that happen?

Thanks!

 

[Brink]

Hello Pallipe,


The MSC file that you created doesn't need to be kept running for the policy changes you make in it to remain enforced. The MSC file acts just like your normal Local Group Policy Editor, but will only enforce policies for all user accounts except those in the administrators group instead. If you wanted to make changes to that policy, then you would just need to run the MMC, make the changes you like, and close it. Any changes will be enforced as applied in that MSC file. That's all.

 

[mq15]

This is a great help indeed. Thanks.

But I am just a beginner in System Administration. I have created .msc file successfully but I don't know how to configure different policies. For example I do not want a student account:
1. to be able to install/unstall a program.
2. to read/write in c:drive
3. access to internet.

I don't know where to find these configuration in the .msc file. Please help.

Regards

 

[Brink]

Hello mq15,

The link below can help you to search and find whatever you need in group policy.
Group Policy Search
If you like for #1, you could use the tutorial below to disable access to "Programs and Features".
http://www.sevenforums.com/tutorials/77679-programs-features-enable-disable.html
If you do #2, then the user will not be able to run Windows since that is on the C drive. They would at least need to have rights to read to be able to function.

It would be best to post a separate thread for #3 to get a variety of options that may work best for you for this.

Hope this helps some.

 

[mq15]

Thanks a lot Brink.
I would start a separate thread if I could not find. Thanks again.

 

[Brink]

You're most welcome.

 

[globaluser]

Hi,

Hi Brink, I have enabled RUN ONLY SPECIFIED APPLICATIONS IN WINDOWS 7 GROUP POLICY , but after this settings has been applied to administrator also, so i'm unable to revert back (unable to open gpedit or regedit ).. can u guys tell to how to revert this back ???

This operation has been cancelled to restrictions in effect on this computer . please contact your system administrator. ( This is the error shown)

 

[Brink]

Hello Globaluser, and welcome to Seven Forums.

Did you create the MSC for "Non-Administrators" before setting the policy with this MSC?

You could either do a system restore using a restore point created before this, or reset group policy back to default to undo this.

 

[globaluser]

Awesome Brink

 

[CovenStine]

Saving/Distributing

Hello,
This works GREAT for my application, but I have quite a few computers to push policies to as we're rolling out Win7 machines here, but won't be switching from AD2003 for a while yet.
I'd seen a suggestion for redeploying GP where an admin could copy the %SystemRoot%\Windows32\GroupPolicy folder from a configured computer to a new one, and run a gpupdate /force, and it's all set.
You've written a script to backup and restore (or redeploy if done right) the GP, but neither option work.
The GP must be stored elsewhere if it's only for non-admins, and I can't be chasing down workarounds if even Admins are denied access to the control panel, this method is the only way to apply GP at this time.
Do you have any suggestions for locating and copying the GP for non-admins?
Thanks!

 

[Brink]

Hello CovenStine, and welcome to Seven Forums.

It's been a while, but see if copying the custom MSC file for administrators to the other computer, import the exported group policies, open the MSC, and force update group policy to see if that may do the trick.

 

[CovenStine]

Hello,
Unfortunately, I haven't been able to export or import non-administrator settings, although admittedly I've only been able to try the LocalGPO tool.
Any further suggestions?

 

[rasctgbd]

SRP not Working with Domain Users

Thank you Shawn.
According to this post, SRP is working fine with me for all local (non-administrator) users, and not working with DOMAIN USERS.

But i want to take your attention into more depth.
In my scenario, my computer in under a DOMAIN also. I want to restrict all DOMAIN USERS as well as non-administrator users.
That means, how do i RESTRICT DOMAIN USERS from running a software (say chrome.exe) by applying SRP from local group/security policy?

NOTE:
I refer the MOTHER post of this post is from http://www.sevenforums.com/general-...n-policies-wrongly-applied-administrator.html.

 

[Brink]

Hello rasctgbd, and welcome to Seven Forums.

You might see if you may be able to use one of the methods in one of the tutorials below for this in a domain.

http://www.sevenforums.com/tutorials/7844-applocker-create-new-rules.html

http://www.sevenforums.com/tutorials/80605-applications-prevent-running-specified-programs.html

http://www.sevenforums.com/tutorials/257189-applications-run-only-specified-programs-windows.html

 

[rasctgbd]

Thank you. I appreciate your posts. This solution is for Local Users only.
What I need is to Restrict DOMAIN USERs as well.

Hello rasctgbd, and welcome to Seven Forums.

You might see if you may be able to use one of the methods in one of the tutorials below for this in a domain.

http://www.sevenforums.com/tutorials/7844-applocker-create-new-rules.html

http://www.sevenforums.com/tutorials/80605-applications-prevent-running-specified-programs.html

http://www.sevenforums.com/tutorials/257189-applications-run-only-specified-programs-windows.html

 

[Brink]

I don't have domain experience to verify, but you should be able to set this in Group Policy to have it applied to the domain.

 

[smo998]

this is a great help thanks for posting. is there a way to change the users associated with this policy after it has been made. say you want to add or change users that are affected by this policy or remove the policy all together. i tried to delete the MSC file but the policy rules still affect those users. (thanks for any advise)

 

[Brink]

Hello smo998, and welcome to Seven Forums.

The policy in this tutorial would be applied to all users except administrators. I'm afraid that you can't pick and choose users to apply it to. If you like, you could use the tutorial below to reset group policy to undo it though.

http://www.sevenforums.com/tutorials/214461-local-group-policy-reset-default.html

If you wanted to apply group policy to specific users, you could use the method in the tutorial below instead.

http://www.sevenforums.com/tutorials/151415-group-policy-apply-specific-user-group.html

 

[mfran2002]

great procedure thanks a lot!!!

only a (very probably stupid) question: I have to set only the policies under "user configuration" section or may I act also under "computer configuration" section without involve the user administrator?

better: if I use this procedure and then modify some policies under "computer configuration", they will be applied also to administrator or not?

thanks again!