Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

If I use the group policy editor (gpedit.msc) in Windows XP Pro to disable the run option from the start menu and stop the user from having the ability to change the desktop wallpaper - is it possible for me to quickly access the Run dialog, or change the wallpaper without changing the group policy back?

Also, if I disable the use of Run - how can I access the gpedit.msc again from that user account?

Thanks.

share|improve this question
1  
On a related side note: Windows Vista and Windows 7 allow for multiple local group policies. – joeqwerty Sep 23 '10 at 22:43

2 Answers

up vote 0 down vote accepted

You'd want to use Group Policies in a Domain if you didn't want them to apply to yourself on that computer and just the user. But if you don't have a domain, you could disable the run and still browse to your gpedit.msc it's in c:\windows\system32 if I'm not mistaken.

You wouldn't be able to just quickly change the wallpaper or run line until you disabled the policy again, that's the whole idea. :)

However...

If you know the user, and can get them to login (or use a login script to check if %username% = victim) then you could apply this registry key (and others that do similar things like disable wallpaper changing)

Disable the run line (without policy) http://www.pctools.com/guides/registry/detail/151/

By changing the key in HKLU (local user) and not HKLM (local machine) you are hitting just your user and nobody else.

Again, using a domain and full featured GPO is much cleaner, but if you are in some workgroup setting than a reg key might be a good idea until they realize they can login as another user... :)

share|improve this answer
Once I have disabled Run for the user using a policy, if I log in as the admin which is completely unlocked in terms of the policy - can I then change the other users' policies from there? Or does it somehow have to be done inside the user account? – dannymcc Sep 24 '10 at 19:40
If you don't want to go the reg key route, you can use this technique (should work for xp too) to apply the policy to users other than the admin. support.microsoft.com/?id=293655 – Matt Sep 24 '10 at 19:54
The thing that's confusing me is how do I alter the wallpaper for example on the user account once I have completely restricted access using a policy - so I would have locked down c:\windows\system32, removed run and other options. Surely I don't have to create a new account every time? – dannymcc Sep 25 '10 at 11:28
You will have to disable the policy on that user to change the wallpaper at that point. Or you could use this little workaround and not mention it to the user. support.microsoft.com/kb/327998 – Matt Sep 27 '10 at 15:32
up vote 0 down vote

Group Policies are absolute, which is why they're so nifty. You can't get past them.

What we've done when we need to remove Run from something is to apply it to the Computer GPO, and set the Loopback Processing flag so it'll for that policy's User policies on users that log in. Sounds a bit backwards, but it does mean that for that station any users that log in will not have a Run dialog.

If we need to get it back for some reason, it is simplicity itself to move the computer object to a location that doesn't have that policy and force a reboot. When it comes up, users will have a run dialog. We can put the restriction back in place just as easily.

share|improve this answer
Could you explain a little further? I have never heard of loopback processing before, I don't think. – dannymcc Sep 25 '10 at 16:17
support.microsoft.com/kb/231287 - You use loopback to apply a policy to an object that would otherwise be outside of the scope available to your policy. Think of two OUs, one for computers and another for users. If I apply a policy to a computer the only way to have a user policy to apply would be to use loopback. – edusysadmin Oct 8 '10 at 0:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.