Controlling user access

I am running XP & need to restrict user access to files & programs on the computer. I have the one computer & have 1 login for employees to use. I need to restrict their access to programs on the computer & restrict their access to items on the start menu.

I have tried this...

Group Policy -> Local Computer Policy -> User Configuration -> Start Menu & Taskbar

In this area I have tried to remove the All Programs from the Start Menu, but it removes the the All Programs from the Start Menu for the Administrator account too. How do I edit the things in this area & make them apply to only certain accounts? I have created a new group under Local Users & Groups for the employees.

 

Hi, lansing.

I am not familiar with the task you are undertaking but I used the forum search utility and searched this Windows XP forum for restrict user access. I came up with links to several threads.

You can find the "Search this Forum" link near the top right corner of the Windows XP Forum thread list.

Perhaps, if you perform the same search (or other searches with different search terms), one of those threads will start you in the right direction.

CAUTION: I suggest you read the entire thread for each one you investigate. Sometimes, the advice given turns out to be less than optimal.

Good luck!

 

Hi, lansing


xp maybe cant restrict certern user on accessing some particular folder...but i'm not very familiar with gp, so maybe i'm wrong on this, if some one how how to accomplish this by gp,PLEASE pose your method blow,thx in advance.

i'll provide you a simple way to go...

1 right-click the folder you dont want your employees to access( in your case is the progame files)
2 choose the 'security' tab
3 add the group you create for the employees group and choose the deny option ,then ok

then,done...

 

As noted, access to various files and folders can be controlled via group permissions, but be careful. You might restrict a user from running a program that you want to allow, by denying access to the program's supporting files (hope that makes sense).

This may work for you to deny access to the All Programs menu. First, set the Admin account to view hidden files and folders, the user account to NOT view hidden files. Now right click the Start button and select Open. Right click the Programs folder and select properties, then change the attributes to hidden. Apply to all subfolders and files. Now right click the Start button and select Open All Users and repeat the process. To prevent users from showing hidden files, open Group Policy>User Configuration>Administrative Templates>Windows Explorer and enable the Removes the Folder Options menu item from the Tools menu.

 

noah,

may i ask how to accomplish this?

sorry , i see it

 

You all have helped out with the information, but how do I make changes that I make in the Group Policy apply to only certain groups? I created a group here Administrative Tools -> Computer Management -> System Tools -> Local Users & Groups -> Groups

I wants to edit that group's policy & not the entire computer wide policy...I am sure we have all used computers either at work & school where the start menu is there, but the only thing you have access is the Log Off button, the File menu is removed from IE & Windows Explorer, & you can't access any thing if you try to right click on the task bar or system tray but when a Manager or Administrator logs on then they have full access to everything in the start menu & all programs.

This is what I am looking for.

 

Create a security group and add the needed people to it.

Download this:

http://www.microsoft.com/windowsserver2003/gpmc/default.mspx

Create another policy to apply to them. Open the tools I had you download and Under security filtering, change the group from Authenticated Users to whatever you named the group they belong to.

 

I have downloaded this program, but when I try to run it I get a dialog box that says " To manage Group Police, you must log on to the computer with a domain user account ". I am logged in as the Administrator. I don't see anything in this window or any link to add a group to this management window.

 

Sorry about that. Looks like it only works on Active Directory domains, not workgroups.

 

How do I change from a workgroup to a Active Directory?

 

You need a server, either 2000 or 2003 will do. If you don't have one or can't buy one then you're out of luck.