How can i prevent a user with a limited account from accessing the Control Panel?

[ManBearPig]

i dont want them to access the control panel at ALL. i got it down so that they cant access it directly, but if they go into a certain folder, they can find a link on the side. how can i make it so that if they DO find that, it wont let them access it? Thanks

And while im here, how can i prevent them from accessing any windows files or anything like that? thanks

 

[eDRoaCH]

how have you restricted them? what OS? Is it part of a domain?

You want to use computer/domain security policies, to shut off control panel, shut off individual controls inside control panel, and disable that stupid 'helpful' bar on the right of the window

the exact settings I dont know, but they ARE in there, you can set EVERYTHING in those policies

xp home/9x need not apply however

 

[ManBearPig]

Originally posted by: eDRoaCH
how have you restricted them? what OS? Is it part of a domain?

You want to use computer/domain security policies, to shut off control panel, shut off individual controls inside control panel, and disable that stupid 'helpful' bar on the right of the window

the exact settings I dont know, but they ARE in there, you can set EVERYTHING in those policies

xp home/9x need not apply however

I restricted them using system mechanic. It got rid of most things, but still cant get rid of the control panel access. I mean, the user probably wont know how to get where i did, but theres a chance...

How can i disable them with windows XP pro?

 

[mechBgon]

Log on as an Admin and go Start > Run > gpedit.msc.

Go to where I've gone in this pic and you can make Control Panel off-limits.

Prediction: you will find many things in Group Policy Editor that cause you to emit evil laughter :evil:

 

[ManBearPig]

Mech...thanks alot...thats really cool lol. Only problem is, it removes the control panel for me, the admin, too Nothing ever works perfect lol.

 

[mechBgon]

You could always cook up a non-Admins-only Software Restriction Policy and restrict Control.exe, I guess... why don't you just make your brother get his own computer to mess with, though?

 

[xtknight]

Are you sure you did User Configuration and not Computer Configuration? User is supposed to be only user-wide.

 

[ManBearPig]

Originally posted by: xtknight
Are you sure you did User Configuration and not Computer Configuration? User is supposed to be only user-wide.

I did it from my admin account. You think if i set that acct to admin, run it there, and set it to limited itd work? Doesnt seem like it.

And mech...my brother has no cash for a computer lol. Id rather he do that though, beleive me And im far too stupid to cook up a-non-admin software restriction policy

 

[xtknight]

Oops. You need to do gpedit.msc and edit User Configuration from the account on which you want the functionality disabled.

 

[ManBearPig]

Originally posted by: xtknight
Oops. You need to do gpedit.msc and edit User Configuration from the account on which you want the functionality disabled.

But when i edited on this admin account it disabled the functionality for both accounts.

 

[xtknight]

Ok, here's what needs to be set.

When running Administrator account:

Computer config option: (default) or control panel on, or OFF I guess if you want only admin by default to be able to access it period.
User config option: Control panel on

Then go in to your limited account where you want the CP disabled.

Computer config option (irrelevant because the limited user doesn't have permission there AFAIK)
User config option: Control panel off

Each account has its own "user config".

 

[ManBearPig]

Xtknight, sounds like a good idea but theres no control panel option in the user config. theres only a control panel option in computer config. So...

anything else? thanks

 

[xtknight]

Hmm. It's here for me (I'm running admin now):

Local Computer Policy\User Configuration\Administrative Templates\Control Panel\Prohibit access to the Control Panel

You mean "user config" is not there when running under a limited account?

 

[mechBgon]

Originally posted by: xtknight
Ok, here's what needs to be set.

When running Administrator account:

Computer config option: (default) or control panel on, or OFF I guess if you want only admin by default to be able to access it period.
User config option: Control panel on

Then go in to your limited account where you want the CP disabled.

Computer config option (irrelevant because the limited user doesn't have permission there AFAIK)
User config option: Control panel off

Each account has its own "user config".

Limited users can run GPEDIT but they get a red-X-of-pwnage, and a no-permission error box. As far as I know of, the only place where the Control Panel can be disabled is the one I mentioned, and it affects Admins too. I believe there's a way that this can be overcome, by first saving the Admin's NTUSER.POL file, then making the changes in GPEDIT, then replacing the Admin's NTUSER.POL with the one that was saved, but don't quote me on that, 'cause I've never tried it and it may be difficult. I'd expect you'd need a second Admin account since I don't think you can replace the NTUSER.POL file while it's in use. More complexity. It would be much easier just to cut the brother's fingers off or something.

BTW Heen05, is he really that bad? Why don't you want him seeing the Control Panel stuff?

 

[ManBearPig]

Eh....well, i just didnt want him or ANYONE else (people are stupid) to ruin it. It seemss like im being anal, but pretty unexpected things happen when people dont know what theyre doing lol.

You guys know of anyway to turn off the blue bar on the left side of the screen that says move to, size, details, etc? if you do, then i probably wouldnt even need to block access to the control panel.

And how can i remove the printers and faxes link on the start menu? and how can i turn off/hide the folder search button when you are in a folder? bahhhhhh.

 

[ManBearPig]

bump

 

[ManBearPig]

 

[skyking]

Originally posted by: mechBgon
Log on as an Admin and go Start > Run > gpedit.msc.

Go to where I've gone in this pic and you can make Control Panel off-limits.

Prediction: you will find many things in Group Policy Editor that cause you to emit evil laughter :evil:

The kind of evil laughter when you first discovered the wonders of the hosts file, and how badly you can mess with someone's head??

 

[ManBearPig]

There are some pretty sweet options, just not what im looking for

 

[MangoTBG]

How often do you actually use the control panel, yourself? Why not disable it and when you actually need it, reenable it? Seems like a lot of fuss for hypotheticals?

 

[ManBearPig]

Originally posted by: MangoTBG
How often do you actually use the control panel, yourself? Why not disable it and when you actually need it, reenable it? Seems like a lot of fuss for hypotheticals?

Actually i use it alot. Not the control panel itself really. but if i disable that, then add/remove programs, which i use ALOT, doesnt work.

 

[ManBearPig]

So...