Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to restrict control panel access to specific users on Windows 2008 R2?

I have only found a way to prohibit access to all limited users in group policy, but not a way to do it for specific users only.

share|improve this question

You should be able to do it with GPO Security Filtering. Create a group for the users that you want to deny access to the Control Panel and add the appropriate users to the group. Create a GPO with the appropriate settings and link it to the OU where the user objects are (or to the domain if the users are in the default Users container), set the Security Filtering on the GPO to apply to only this group (and remove Authenticated Users).

share|improve this answer
Hmm so no way to do it simply per user? – James Bates Dec 25 '11 at 0:10
Yes, create a group, add the user to the group, follow my instructions above. – joeqwerty Dec 25 '11 at 5:01
Yeah, so no straight way to add a user without farting around with a group first. Sigh. Thanks. – James Bates Dec 25 '11 at 22:07
No, you can use Security Filtering to make the GPO apply to only a single user, but it's recommended to use groups for this purpose, much as it is for assigning NTFS permissions to resources. – joeqwerty Dec 25 '11 at 23:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.