Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I set up a Active Directory on a server machine with Windows Server 2012 and I'd like to create some users with limitations like Windows Steady State does in Windows XP (locally).

Seen already the Windows SteadyState Handbook (with Windows Server 2008), but I'd like to know if anyone has tried this before, the limitations are the following:

1. Prevent locked or roaming user profiles that cannot be found on the computer from logging on
2. Do not cache copies of locked or roaming user profiles for users who have previously logged on to this computer
3. Do not allow Windows to compute and store passwords using LAN Manager Hash values
4. Do not store usernames or passwords used to log on to the Windows Live ID or the domain
5. Prevent users from creating folders and files on drive C:\
6. Lock profile to prevent the user from making permanent changes
7. Remove the Control Panel, Printer and Network Settings from the Classic Start menu
8. Remove the Favorites icon
9. Remove the My Network Places icon
10. Remove the Frequently Used Program list
11. Remove the Shared documents folder from My Computer
12. Remove control Panel icon
13. Remove the Set Program Access and Defaults icon
14. Remove the Network Connection(Connect To)icon
15. Remove the Printers and Faxes icon
16. Remove the Run icon
17. Prevent access to Windows Explorer features: Folder Options, Customize Toolbar, and the Notification Area
18. Prevent access to the taskbar
19. Prevent access to the command prompt
20. Prevent access to the registry editor
21. Prevent access to the Task Manager
22. Prevent access to Microsoft Management Console utilities
23. Prevent users from adding or removing printers
24. Prevent users from locking the computer
25. Prevent password changes (also requires the Control Panel icon to be removed)
26. Disable System Tools and other management programs
27. Prevent users from saving files to the desktop
28. Hide A Drive
29. Hide B Drive
30. Hide C Drive
31. Prevent changes to Internet Explorer registry settings
32. Empty the Temporary Internet Files folder when Internet Explorer is closed
33. Remove Internet Options
34. Remove General tab in Internet Options
35. Remove Security tab in Internet Options
36. Remove Privacy tab in Internet Options
37. Remove Content tab in Internet Options
38. Remove Connections tab in Internet Options
39. Remove Programs tab in Internet Options
40. Remove Advanced tab in Internet Options
41. Set a home page (Internet Explorer)
42. Restrict the possibility to change desktop image
43. Restrict the possibility to change wallpaper
44. Restrict usb flash drives

Any suggestions for this?


I'll offer a bounty of 50 points for someone who can help me out


As @Dan suggested me I'd like to specify that would be applied to a educational scenario where students can login from a computer and want to add some restrictions to them.

share|improve this question
It's not clear from your question, but restrictions or no restrictions, you should never be designing a system where users log on to a Domain Controller. – Dan Oct 20 '12 at 15:56
@Dan: What is not clear? I'm trying to switch the old network of an high school. I want to limit the students in order to avoid to much extra work; hope that makes more clear now. Do you have any other suggestions for me? :) – el.severo Oct 20 '12 at 16:24
I wasn't sure where the users were logging on to. In this situation, the client devices are just as relevant as the server, if not moreso. You should add more detail to your question. – Dan Oct 20 '12 at 16:27
Make sure you're not giving the users "Administrator" rights on the clients and, at that point, most "restrictions" become meaningless. – Evan Anderson Oct 20 '12 at 17:23
@FalconMomot: A local Administrator on a domain-joined computer can override anything they want in Group Policy just manhandling the registry. "Enforced" GPO settings are a handy feature, but not a security boundary.… – Evan Anderson Oct 22 '12 at 17:25

Based on a cursory review of your list, you should be able to manage all of those settings with Group Policy. Create a GPO for the computer settings and another GPO for the user settings and link them to the appropriate Container or OU. You can use Security Filtering in each GPO to apply each GPO to specific Users and Computers.

share|improve this answer
Thanks! I'll try! :) – el.severo Oct 20 '12 at 15:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.