Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a few local accounts on a Windows XP machine.

The local account is called localUser1 ... localUser16

I need to lock the accounts down so the ONLY application that is allowed to run is Notepad.exe

All domain accounts, local Admin accounts should be unaffected.

Is this possible? If so then how to execute it?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

XP doesn't have the ability to use gpedit to affect different local users differently, so all local accounts would get settings applied, even admins.

Windows 7 has this capability called "Multiple Local GPO" http://technet.microsoft.com/en-us/library/cc766291%28v=ws.10%29.aspx

For XP there is a really old tool called "XP Security Console" by Doug Knox that might help you: http://www.dougknox.com/xp/utils/xp_securityconsole.htm

share|improve this answer
    
This is what happened to me before. Now I have to image 20+ PC's because we can't reverse the GPEdit to deny all applications except notepad. We cant even open GPEdit –  Cocoa Dev Nov 28 '12 at 18:04
    
That's where the 2nd tool comes in. It is per user (the free version you have to do it logged in as the user you want to change) –  TheCleaner Nov 28 '12 at 19:40
add comment

One thing you could do here is allow gpedit.msc and notepad.exe to be run. Non admin users won't be able to edit group policy but it will allow the admin users to "disable computer and user policies" after logging in in order to "unlock" the workstation to make changes.

share|improve this answer
    
Why not just add an ACE to the GPO to deny Apply Group Policy to admins? –  Greg Askew Nov 28 '12 at 16:12
    
Nevermind - forgot they are local accounts. –  Greg Askew Nov 28 '12 at 18:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.