Can I set a group policy around the administrative account?

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I would like to set up a series of group policies on a limited account, but I
would like full access with my administrative account. Is this possible on a
local machine, so Active directory is not needed?
 
(e-mail address removed),
Josh B. said:
I would like to set up a series of group policies on a
limited account, but I would like full access with my
administrative account. Is this possible on a local machine,
so Active directory is not needed?
Click to expand...

Take a look at these articles,

The Most Frequently Asked Question About Group Policy In A
Workgroup Situation
http://www.theeldergeek.com/gp07.htm

Lockdown by group using Local Computer Policy without Active
Directory
http://www.windowsnetworking.com/kb...ocalComputerPolicywithoutActiveDirectory.html

How to apply local policies to all users except administrators
in a workgroup setting in Windows 2000
http://support.microsoft.com/default.aspx?scid=kb;en-us;293655

I've found the first option to be the easiest to implement. It
also helps to put shortcuts on the desktop of your account to
gpedit.msc or secpol.msc and the C:\WINDOWS\System32 folder.

Here are some alternative approaches you might want to look
into.

Windows XP Security Console
Courtesy of Doug Knox, MS-MVP
http://www.dougknox.com/xp/utils/xp_securityconsole.htm

Microsoft Shared Computer Toolkit for XP
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx

Good luck

Nepatsfan
 
Nepatsfan said:
(e-mail address removed),


Take a look at these articles,

The Most Frequently Asked Question About Group Policy In A
Workgroup Situation
http://www.theeldergeek.com/gp07.htm

Lockdown by group using Local Computer Policy without Active
Directory
http://www.windowsnetworking.com/kb...ocalComputerPolicywithoutActiveDirectory.html

How to apply local policies to all users except administrators
in a workgroup setting in Windows 2000
http://support.microsoft.com/default.aspx?scid=kb;en-us;293655

I've found the first option to be the easiest to implement. It
also helps to put shortcuts on the desktop of your account to
gpedit.msc or secpol.msc and the C:\WINDOWS\System32 folder.

Here are some alternative approaches you might want to look
into.

Windows XP Security Console
Courtesy of Doug Knox, MS-MVP
http://www.dougknox.com/xp/utils/xp_securityconsole.htm

Microsoft Shared Computer Toolkit for XP
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx

Good luck

Nepatsfan
Click to expand...


I took a look at these sites, and it is great informatin, but im running
into the issue of using an admin account to make the group changes, then
restarting and lokcking down the admin accounts too. I have a limited account
and 2 admin accounts, the limited is the only account i wanted limited. I'm
having the issue of locking out the limited account and the admin account i
set the policies on.
 
(e-mail address removed),
Josh B. said:
I took a look at these sites, and it is great informatin,
but im running into the issue of using an admin account to
make the group changes, then restarting and lokcking down
the admin accounts too. I have a limited account and 2 admin
accounts, the limited is the only account i wanted limited.
I'm having the issue of locking out the limited account and
the admin account i set the policies on.
Click to expand...

If you looked at the first site I listed then you saw the
easiest way I know of to prevent some of the local group
policies from being applied to accounts that are members of the
Administrators group. The major shortcoming of that approach is
that it only works for the User Configuration branch of the
Local Computer Policy. If most of the policies you want to see
enforced are in the Computer Configuration branch then you're
going to have to look elsewhere for a solution. The Shared
Computer Toolkit might be do the job.

Another thing to keep in mind is that some policies go into
effect as soon as you enable them. If you use the "Deny read"
procedure, you have to log off and log back on with your
administrator account to not have those policies applied to
that account. That's one of the reasons why I advised placing
shortcuts to gpedit.msc and the C:\WINDOWS\System32 folder. If
you don't, you may find yourself locked out of reversing the
policies.

If you tried the "Deny read" procedure without success, post
back with details of what you tried and the results you got.

Meanwhile, you might want to post your question to the Group
Policy newsgroup.

Discussions in Windows Group Policy
http://www.microsoft.com/communitie...aspx?dg=microsoft.public.windows.group_policy

Good luck

Nepatsfan
 
Back
Top