Local Computer policy questions (2K/XP)

[CrazyHelloDeli]

How would I be able to configure a Local Computer policy in either 2K or XP to lock out control panel for example, for one Local user account, but NOT have it apply to other Local users on the same machine. As far as I know, its simply not possible to do something like this without a domain using OU's, but I wanted to see if anyone here had any ideas, or maybe knew some third party utility that can do what im asking.

From what ive already tried to do, if I make a change to a local computer policy it affects all users on that machine, unless for instance, the particular policy has the option to filter by the user, like some of the security settings under Computer Configuraton.

 

[Nothinman]

The 'creative' way we got around this where I work on the Citrix boxes is to deny access to the policy files for the people you don't want to have them applied to, since the files can't be read the policies can't be applied and are silently ignored.

 

[TW2002]

The creative way as described is the only way for this situation.

Basically you deny read on %systemroot%\system32\GroupPolicy for any group you do not want the policy to apply to. Be careful not to lock yourself out if you have background policy refresh enabled.