This might work. Configure Local Security Policy [gpedit.msc] user
configuration/administrative templates/system/run only allowed Windows
applications [read complete explaination] and enter iexplore. Once the is
enabled, you will not even be able to access Group Policy anymore unless you
add mmc.exe to the list OR you can manage Group Policy on that computer
remotely from another network computer while logged on as a user with admin
credentials on the lockdown computer and use mmc/Group Policy snapin - other
computer. You would want to delete the other icons on the desktop and change
the ntfs permissions on the desktop folder for the user profile to be used
to be read/list/execute. You can use Group Policy user configuration to also
remove most everything else from the desktop. I would also change the
settings for the internet Web Content Zone so that they can not download and
then use Group Policy to hide the configuration pages for Internet Explorer
so that they can not change settings. I would also change the ntfs
permissions to the root/drive folder so that users/everyone has only
read/list execute permissions including in the advanced permissions page.
That should get you off to a good start. Keep in mind that this lockdown as
is may not allow Windows Update to work, you would have to tests that out or
temporarily relax or otherwise tweak settings [such as allowed applications]
when you need to do system maintenance. --- Steve
sydney said:
Hi!!
I want to configure a windows 2000 PC for users who want to "surf" during
their lunch break. What do I need to configure on this PC?
