Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a few local accounts on a Windows XP machine.

The local account is called localUser1 ... localUser16

I need to lock the accounts down so the ONLY application that is allowed to run is Notepad.exe

All domain accounts, local Admin accounts should be unaffected.

Is this possible? If so then how to execute it?

share|improve this question
up vote 2 down vote accepted

XP doesn't have the ability to use gpedit to affect different local users differently, so all local accounts would get settings applied, even admins.

Windows 7 has this capability called "Multiple Local GPO"

For XP there is a really old tool called "XP Security Console" by Doug Knox that might help you:

share|improve this answer
This is what happened to me before. Now I have to image 20+ PC's because we can't reverse the GPEdit to deny all applications except notepad. We cant even open GPEdit – Cocoa Dev Nov 28 '12 at 18:04
That's where the 2nd tool comes in. It is per user (the free version you have to do it logged in as the user you want to change) – TheCleaner Nov 28 '12 at 19:40

One thing you could do here is allow gpedit.msc and notepad.exe to be run. Non admin users won't be able to edit group policy but it will allow the admin users to "disable computer and user policies" after logging in in order to "unlock" the workstation to make changes.

share|improve this answer
Why not just add an ACE to the GPO to deny Apply Group Policy to admins? – Greg Askew Nov 28 '12 at 16:12
Nevermind - forgot they are local accounts. – Greg Askew Nov 28 '12 at 18:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.