Resolved Win Srvr 2003 - Group Policies

I need to lock a server down and have been learning as I go.. I launched Gpedit.msc ....

I can't help but think that there is a way to lock a "Group" of users down without affecting the Admin Group. I added 14 users and added them to USERS, Remote Desktop and to a group COMPANY that I had created.

I'd like to be able to deny access to things like the shutdown button, control panel etc....

Can this be done? Can I lock the group called COMPANY down?

EDIT: This is not a domain controller and active directory is not running.

 

I was getting a little excited until I read the last bullet point:

This is a Win Server 2003 machine.... Thanks for the reply.

I found a similar article with pictures here:
http://www.sevenforums.com/tutorials/151415-group-policy-apply-specific-user-group.html

 

I agree..... Except for maybe it being and older OS.

On one hand we can go months without needing to access the machine and do anything... On the other hand, I'd hate to have to manually tell some of the admin level helper bees to disable some of the restrictions.

 

Hi Steve. These links should be helpful:

How to Prevent Shutdown of a Windows XP Computer

How To Disable Control Panel in Windows 7

Policy settings for the Start menu in Windows XP

How to Apply Local Group Policies to Specific User or Group in Windows

I haven't used Windows Server 2003 but the path in Group Policy for the restrictions should be the same regardless if you are following an article designed for Windows 7 or Windows XP.

 

Thanks Evan.... Your last link is the same that I posted above... Item #6 in that link isn't there for 2003...

Have a feeling I'll have to disable several things to keep the dummy's out of certain areas which will also affect the Admin group.

 

This method should work.

 

It should work except for the part about:

I just can't win for losing...

 

I found this so I think you are out of luck.

 

Thanks Mr "Terminator" for killing my dreams

But really, thanks for helping me...

Most of my terminal server clients launch our accounting app and never see the desktop.... Another one like my current client has access to the desktop...but they are the only company on the machine...

This new client is sharing a machine with another company that doesn't see the desktop..

I touched base with our data center...Course they don't care what we do...but mentioned that I should mention Group Polices are in place if and when they need to do something.

 

I didn't mean to 'terminate' this thread but unfortunately that's how this issue has turned out.

If you need to restrict access to the server wouldn't it be easier to just allow admins onto the server if they enter the correct credentials or only allow physical access to the server when its under supervision by another manager?

 

The server hosts the accounting software my company makes. There are 14 people that need to use it all day long. The client in question also needs to be able to import transaction from excel spreadsheets..

 

Would it be possible to run the accounting software with a limited user account on the server? The answer is most likely a no since the software probably requires administrator permissions to run though.

Have you looked at the features of this application, Deep Freeze Enterprise? It might be something you can use to undo unwanted changes without having to setup a lot of restrictions for the administrator group.