Lockdown Desktop no Domain

  • Thread starter Thread starter Barry
  • Start date Start date
B

Barry

I'm trying to figure out a way of locking down the
desktops on some open access PC's in a library, the PC's
are not members of a domain. I can't seem to get my head
around group policies; can I use them without a domain
controller? How do I set a policy on an individual user?
Do I have to understand administrative templates and
these .adm files? Maybe I should be using poledit and
config.pol files, is poledit on the WinNT Resource Kit CD
or Win2000 Pro Resource kit? I remember using that years
ago on NT Systems.
Or perhaps I should be using a 3rd party tweak utility
seeing as I'm fairly new to policies, can someone suggest
a good utility I can use? So many questions such a short
deadline. Any help or URL's to idiot's guide to
understanding polices would be greatly appreciated.
 
You can't use group policies without a domain. You need to use local
policies.

Start - settings - control panel - administrative tools - local security
policy

hth
DDS W 2k MVP MCSE
 
Or, even better,
Start > Run > gpedit.msc <Enter>
This will give you access to all local policies, not only to security
settings.

Al.
 
Local Group Policy is invoked via gpedit.msc. Keep in mind that Local Group Policy
applies to ALL users that logon to a local computer, though there are a couple of
hacks to get around it. If you lock yourself out you can use gpedit.msc to manage the
locked out computer remotely if you are logged onto the remote computer with as a
user that is an administrator of the target computer. Ntfs permissions should also be
part of your lockdown strategy, and keep in mind that you want to configure the
computers to boot from only the hard drive, disable autorun on the cdrom, disable usb
ports in cmos if possible, password protect cmos settings, and use a computer case
that has a lock on it. The reason is that it is pretty easy for a user to boot from a
floppy or cdrom and reset the built in administrator account. --- Steve

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q293655&
http://www.jsiinc.com/sube/tip2400/rh2492.htm
 
You could create a custom template and apply it locally to each workstation.

309689 HOW TO: Apply Predefined Security Templates in Windows 2000
http://support.microsoft.com/?id=309689

321679 HOW TO: Manage Security Templates in Windows 2000 Server
http://support.microsoft.com/?id=321679

216735 Methods Used to Apply Security Settings Throughout an Enterprise
http://support.microsoft.com/?id=216735

310516 HOW TO: Add, Modify, or Delete Registry Subkeys and Values by Using a
http://support.microsoft.com/?id=310516

816297 HOW TO: Define Security Templates By Using the Security Templates
http://support.microsoft.com/?id=816297

323639 HOW TO: Create Custom Administrative Templates in Windows 2000
http://support.microsoft.com/?id=323639

Buz Brodin
MCSE NT4 / Win2K
Microsoft Enterprise Domain Support

Get Secure! - www.microsoft.com/security

This posting is provided "as is" with no warranties and confers no rights.

Please do not send e-mail directly to this alias. This alias is for
newsgroup purposes only.
 
Back
Top