Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to restrict access for specific (non admin) users to cmd, windows tools, explorer on an Wim XP system?

Partially I consider to do this through group policy & logon script 1. deny access to cmd, local disks, registry editor, etc from group policy (allow batch) 2. configure a logon script which for admin users removes this restriction from registry, for non admin users it will not be able to remove restrictions because it does not have rights.

Is there a better and which should also cover more restriction items?

share|improve this question
possible duplicate of How to lock down Windows XP for use as an internet kiosk? – mailq Sep 22 '11 at 15:57

If you set restrictions via Group Policy, don't use a registry hack script to unset them. On the next policy refresh, the GPs will reapply and all changes will be lost.

We do this by having two user configuration GPOs, one which sets all of the restrictions for regular users. We then have a second GPO with a higher priority link order and security filtering so that it applies only to administrators. That way, during GP application, the system will apply the appropriate permissions, based on who is logged in.

Remember, only user configuration settings can be done this way (since Computer Settings apply at startup and doesn't evaluate who is logged on)...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.