controlling non-admin account

[iGotQuestion]

hi,

i have two accounts on my windows 7 computer, an administrator account and a standard user account. i would like to prevent the standard account from accessing the command prompt, regedit, and a couple other things.

i tried using the local group policy editor but the settings there apply to the administrator as well.

how can i use the local group policy editor settings but only apply them to the standard user account?

i would like to avoid using third-party software if possible

 

[richc46]

Welcome

I may be wrong, but I think what you want is already built in. Without an adm pasword, there is very little that a standard user can do. He can access the cmd, but it is a limited cmd (without elevated priviledge etc). Give it a try, go a standard account and see what you can actually do; not all cmd prompts are equal.

Try assesing the areas that concern you and then try actually using them and see what happens.

 

[Bare Foot Kid]

Hello iGotQuestion.



Have a look at the tutorial at the link below to see if it's any help with what you want; be sure to post back to keep us informed.


Local Users and Groups Manager - Open

 

[iGotQuestion]

its not just the command prompt i'm trying to disable.. there are a lot of other things in the local group policy editor that i would like to apply to just the standard account and not the administrator account

 

[Bare Foot Kid]

Hello iGotQuestion.



Have a look at the tutorial at the link below to see if it's any help with what you want; be sure to post back to keep us informed.


Local Users and Groups Manager - Open

Did you see this?

 

[iGotQuestion]

yes srry.. that was posted just as i was posting my second post

 

[Bare Foot Kid]

yes srry.. that was posted just as i was posting my second post

Does it look like it'll be a help to you?

 

[iGotQuestion]

ok.. so i read the stuff in the link above.. how would i go about applying the settings in the local group policy editor to a user in local users and groups manager?

 

[Bare Foot Kid]

ok.. so i read the stuff in the link above.. how would i go about applying the settings in the local group policy editor to a user in local users and groups manager?

I haven't had a need to do so, hopefully someone who has will be along shortly to help, keep checking back.

 

[Barman58]

You should be able to control access to programs by using NTFS permissions, in the programs folder(s), to remove the ability of normal users to access them - be sure to remove the users and everyone groups from the permissions but to give the admins and your actual user enough control.

this docx may be of some assistance ....

View attachment Configuring Windows 7 for a Limited User Account.docx

more reading I'm afraid

full article here ...

http://go.microsoft.com/fwlink/?LinkId=165706

 

[Bill2]

I just noticed, you're using win7 RC. That edition is time bombed, it'll expire on June1. After that, it'll be virtually unusable. I hope you have planned to acquire RTM before that.

 

[iGotQuestion]

hmm... this is good but ideally i would like to use the group policy editor. is it possible to use the management console to do this?

blocking access to programs is one the things i want to achieve along with things like custom homepages, disable windows update, etc. which are all available in the group policy editor

 

[iGotQuestion]

@Bill2.. i'm using windows 7 final now.. hadn't updated the thing in the forums

 

[Bill2]

Well, as far as Regedit and Command Prompt are concerned, the most convenient way would be to set them to run as administrator. Obviously for this you need to have a password protected admin account. Login to your Standard user account, right click on on each exe, then check the box labelled run as administrator. It'll prompt you for your admin credentials. Of course the admin user will also be required to enter the admin credentials but thats a small price to pay. Turning these off in gpedit will, afaik, turn them off for all users.

Try doing this, then get back so we know whether it works. We'll go ahead from there.

 

[iGotQuestion]

that worked but i think i found a better solution. i went to the microsoft management console and added a new group policy object snap-in. when the "select group policy object" window opened i selected browse ---> users ---> non-administrators. then i enabled all the group policies i wanted and they were applied to the standard account, not the administrator account, like i wanted.

the only problem i have now is that if i open the management console again.. the snap-in is not visible under the console root. this means that i wont be able to revert the changes i made if need be. is there a solution to this?

 

[Barman58]

If you save the console that you have created it should then be openable at will as a separate GPedit

It is an admin only application so should be safe but best saves in the admin account start menu to be sure

One other thing the Windows update can be switched off for non admin users in the windows update applet in control panel

 

[iGotQuestion]

I noticed that once the file was saved and then deleted.. the account still had the restrictions that i had set but when i open up gpedit.msc the settings concerned were in their default state. so in this case if the saved file is deleted.. i don't see anyway of reverting the changes i originally made to the standard account.

this is a big problem for me because.. the computer is my friends laptop and i need to be able to revert the settings should something not work as my friend intended it to.

 

[Barman58]

The test file I made was only 66kB so all I could suggest is to make a backup of the custom console and take it with you - did you re-try making the same console after you deleted it - will the settings show then?

 

[iGotQuestion]

once i have used the mmc snap-in and configured the group policies i cannot revert the changes regardless of if i have the mmc file or not. if i then go to gpedit.msc and make the same settings, they are applied system wide as expected.

 

[Barman58]

Ok I've just changed an item on my test console here When I close the console I was prompted to save changes to console - which I accepted.

When I re-opened the console file, by clicking on the file, the changes I made were still present and could be edited.

So there is some retention - As I said, AFAIK the only real way to protect these changes would be to copy the file of the system