User Profiles in XP Pro

[Jedi940]

I have a computer that I am trying to create a user profile on and I can't figure out how to do what I want. I would like to create limited access beyond the "users" group by disabling windows update and the control panel as well as a few other things. The only way I have found to do that is through the management console by adding a snap-in group policy but that disables things for the Administrator as well and I have to re-enable them in order to use them. This is very annoying. How do I create a user profile that does not interfere with the built in administrator account? Is this possible or do I need to create a group policy on another computer on the network and do all my administering from there? I know that I can specify a profile path for each user on the machine. Is this what I want to do? how do I create a profile.

Links to sites are acceptable. I am not opposed to doing my own work I just haven't found a site that explains what I want to do yet?

 

[Nothinman]

There are some hacks you can do to exclude the admin account but AFAIK without AD to do things more fine grained any policies applied will apply to everyone.

 

[Jedi940]

In that case, would it be possible to create an account that would point to a profile on another computer that would allow me to have full access? I just want to be able to log on to the computer locally and have full access to everything without having to disable all the settings everytime.

This just occurred to me. I have never worked with domains before so I might be way off but what if I create an administrator account on a different domain from the local users. Would this help or is that that same as what I first suggested?

 

[Nothinman]

Even if you specify a profile on a separate server, share, etc it'll still be loaded locally and have policies applied as long as those policies can be read by the local user.

If you have an AD setup then you can apply the GPOs to a certain OU and have your admin account in a different OU without those GPOs applied.

 

[Jedi940]

OU?

 

[Nothinman]

Organizational Unit.

 

[Jedi940]

Well, after some further research, I believe I will need to start a server and put the computer on a domain. Then all users will be authenticated through the server and I should be able to create different users. This will allow me to log on to the local computer with full admin rights shouldn't it? I have very little knowledge about servers and domains so if you have any suggestions as to websites or books that would be good reading, it would be appreciated. I have a legit copy of 2000 server so that is probably what I will end up using unless there is some reason I shouldn't. The server would be running with both XP and Vista computers.

 

[Nothinman]

I believe you'll still need separate OUs to apply the different GPOs and not just separate users, but it's doable.

 

[Jedi940]

I have never worked with organizational units. Where can I learn more about how to configure them? I need a good starting point to begin learning how to do such things. I will probably set it up at home with two computers, (server, client) and try to different things from there. I have just never done it and want to learn.

 

[Nothinman]

They're a basic part of AD, I've never looked at any books or anything but I'm sure they've all got to cover them.

 

[Jedi940]

ok. thanks for the help