Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am in charge of locking down many public computers for a public library. Because Windows SteadyState is not supported in Windows 7, I use group policies. These policies affect all users, including the administrator account. I would like to place shortcuts on the administrator desktop to toggle certain policies. These are non-domain machines and are all running Windows 7 Professional. So far I have not been able to easily toggle specific policies. I would prefer to NOT have to open the gpedit.msc and locate each policy that I want to toggle. Instead, I would like to be able to click on a desktop shortcut to enable or disable certain policies. Can anyone point me in the right direction? Thanks.

share|improve this question
2  
I think you might be going about this the wrong way. What policies are in place that you would like local admins to be able to circumvent and why? Maybe there's something in your workflow that can be changed rather than trying to implement this policy "toggling" which really isn't done. –  MDMarra Oct 18 '12 at 17:27
    
If you arent familiar with Windows SteadyState and public-use machines in an educational and/or kiosk-like environment then it may be difficult to understand the how and why. –  cop1152 Oct 19 '12 at 14:04
    
I am familiar with SteadyState, but you say in your question that you aren't using it, which is why I asked what specific policies you'd like to be able to toggle. –  MDMarra Oct 19 '12 at 14:14
    
I think I have figured out with EA's answer..some of it anyway. I cant list each specific policy here. If you would like an idea, take a look at what SteadyState does. Specifically the restrictions listed under Start Menu, General, IE, Office, and program blocking and also the "set computer" tab. –  cop1152 Oct 19 '12 at 14:33

2 Answers 2

up vote 2 down vote accepted

There's no method to make automated changes to the settings within Group Policy. There's just no API there. There is a Group Policy API for PowerShell, but it it concerns itself with linking/unlinking GPOs, backup/restore, etc.

If you haven't you should look at multiple local group policy as a potential solution to your concerns for user policy settings. For computer policy settings, though, you're outta luck.

share|improve this answer
    
thanks for the link, EA. –  cop1152 Oct 18 '12 at 17:34

Group Policies really just modify the registry, so what you'll need to do is isolate what keys are being changed and make .reg files to override them. When Group Policy refreshed (45 minutes at the default value or the computer reboots), these will be overwritten again. This is not a great solution, for obvious reasons. Also, many policies only take effect on boot/logon/whatever, so this would not work for those.

There's really not a good way to exclude certain users from computer policies. That's the whole point of computer policies - they're not influenced by which user is active.

share|improve this answer
    
Thanks for the info. I didnt really want to use .reg's. –  cop1152 Oct 18 '12 at 19:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.