At work there are over 30 PC, some of them are Windows Vista Home and Windows 7 Home.

I just realized Windows Server is not worth it because it require to connect "Domain" on the clients PC. Windows Home does not support that and it will be very expensive buy licences for Professional or Business windows.

I am looking for alternative to Windows Server, something basic that I can block the desktop, some software, USB devices, and limit access to the websites.


  • What are your plans for the server, what are you going top use it for? Just file serving?
    – Moab
    Jul 1, 2011 at 19:29
  • @Moab: It looks like he wants some group policy stuff done as well.
    – paradroid
    Jul 1, 2011 at 20:13
  • Actually, this can ALL be done through group policy. USB (Admin template), Desktp(Windows template), and website (IE template).
    – surfasb
    Jul 1, 2011 at 20:55
  • Home editions of Windows do not support Group Policy Objects.
    – nhinkle
    Jul 1, 2011 at 22:43
  • 3
    Im gonna get flammed but you should consider using linux for that if money is an issue.
    – OneOfOne
    Jul 2, 2011 at 7:34

5 Answers 5


Oddly enough, everything you are asking to do is part of the reason why PCs SHOULD join a domain. Since you can do pretty much everything you ask for with the OS. But I digress. You can do this all manually without joining a domain by logging onto each computer and first changing the Local Admin password.

Use the Group Policy editor to change the current settings on the computer. Go to the next computer. Rinse and repeat for 30 computers . . .

An alternative is to look at Windows Small Business Server. It is still a chunk of change, but I ask that you rethink your decision. Keep in mind if you lock down these computers, you'll have to pretty much login to EACH computer to update a single component, like Flash. Otherwise, every time your users log in, they'll be presented with the Flash update dialog, then try to update, and they have to cancel cause they don't have admin rights. And that will continue EVERY TIME THEY LOG IN, until you get around to their machine . . .

edit: Humm, I did think of a faster way. Save the registry edits that Group Policy editor does and merge them into each computer. Dangerous yes. But free!!!!!!!!!

  • Windows Small Business Server doesn't require connect to "Domain"? Can you provide a link about that... Regarding to Group Policy editor to change setting on each much is very time consuming - is there a way just one click on every PC?
    – user79590
    Jul 1, 2011 at 19:25
  • I should reword that. I think it would be very helpful to explain why NOT connecting to a domain is a part of your specifications in the first place. Cause everything you want to do is a cake walk when the computers ARE connected to a domain. It takes some serious work and magic otherwise. Microsoft didn't hire an entire Server Division just to write a piece of software that reproduces functionality that just ANYONE can do.
    – surfasb
    Jul 1, 2011 at 19:41
  • 1
    @Shinrai: For work, I just translate business requirements into IT specs by providing the equivalent IT solution that will fit their vision. I leave it up to the project managers to calculate the man hours. HAHA!
    – surfasb
    Jul 1, 2011 at 20:53
  • 1
    Fair enough @surfasb. But in this case I think scaring the guy is exactly what we need to do, because frankly, it'll cost his company more long term to pay him to figure out some crazy home-brewed solution than it would for them to just buy Windows 7 licenses. Which I think was pretty much the point of your answer :) See also, my answer below.
    – nhinkle
    Jul 1, 2011 at 23:30
  • 1
    +1 for having alizee as your avatar - great minds think alike! :P
    – Alex
    Jul 2, 2011 at 3:05

There are a few routes you could take. Ultimately, having a centrally managed system using Active Directory is going to be far easier for you than trying to jerry-rig the functionality built-in to Professional versions of Windows, but there are options:

Option 1: Buying Windows 7 Professional

  • BizSpark: If your company is a start-up, you are eligible for the Microsoft BizSpark program, which gives companies access to a wide variety of Microsoft software for extremely reduced prices. You could obtain both Windows 7 Professional and Windows Server licenses through this program.

  • Volume Licensing: If you need to buy licenses for anywhere from 5 to hundreds of thousands of computers, Microsoft Volume Licensing is the easiest and overall cheapest method. Depending on what type of agreement you make, you can either purchase 30 upgrade licenses just once, and install Windows 7 Pro on all of your machines, or you can purchase a Software Assurance agreement, which entitles you to upgrade (or downgrade) to any version of Windows, even when new ones are released.

  • Retail upgrade licenses: this is probably the most expensive option, so I would advise against it, but you can just flat-our purchase upgrade licenses. Since you mentioned expense in your question, this is probably not a great suggestion.

Option 1.5: Alternatives to Windows Server, but still buying Windows 7

If you can swing some Windows 7 Pro licenses, but don't want to pay for a Windows Server license (which can be quite pricey), there's also the option of using SAMBA as your domain controller. This gives you most of the functionality you're asking for - essentially, the ability to set up group policy. It runs on Linux, and there are also lots of options for internet filtering which run on Linux as well.

Option 2: Jerry Rigging

If your organization really can't afford Windows 7 Professional licenses (and really, trying to spin your own solution will most likely cost you more long-term because of all the development and support time, but as you wish), you can try to make your own solution. I've done this before for around 10 computers, so it's probably doable with 30, it'll just be painful, and if your organization grows even further, it'll really suck.

You'll want to check out the Group Policy Settings Reference for Windows. This gives a comprehensive list of all Group Policy Settings (which are what you use to restrict users' desktop actions), including - most importantly - the registry settings for these restrictions. There are a few problems though:

  • Not every restriction has a registry setting. Some of them are stored in other ways which you can't easily change.
  • When you apply these settings manually, there's no easy way to do it for just certain groups on the computer. For each account, you would have to manually import the settings. You could probably write a PowerShell script or something to automate the process, but there are further complications with that.
  • When you want to change a setting, you have to do it for every single user on every single computer. Which, again, will be miserable.

So yes, it is possible to get around the limitations of having Home editions of Windows, and hopefully that document will be a good place to start. But I still think it's going to be way more trouble than it's worth.

The other question to ask yourself is, "is it worth all this trouble just so that users can't change their background picture and access the command prompt?" In most small organizations, the answer is probably, "no, it isn't," so if your supervisor is demanding that you implement these restrictions - which more often than not get in the user's way rather than save anybody time - you should really make the argument that if they want to enforce those rules, they'll have to buy the proper tools to make it possible.

  • I keep forgetting that Home editions can't join domains . . .
    – surfasb
    Jul 1, 2011 at 23:32
  • @surfasb: That's odd, as that is what this question is all about, and your answer was selected.
    – paradroid
    Jul 2, 2011 at 1:26
  • @nhinkle: Isn't Samba just a file server? Can it do all the LDAP stuff to make it an alternative to a Windows domain controller?
    – paradroid
    Jul 2, 2011 at 1:29
  • @paradroid Samba v.3 (which is the current stable release) can act as an NT4-style domain controller. Samba v.4 (currently in development) will be able to act as an active directory domain controller. Many organizations use Samba as a complete alternative to Windows Server - it does file sharing, printing, and domain control.
    – nhinkle
    Jul 2, 2011 at 1:30
  • @nhinkle: Oh, okay, I didn't realise.
    – paradroid
    Jul 2, 2011 at 1:34

You're going to have to set up a server. I'm surprised you didn't have one already with 30 PCs in one office.


The home versions of Windows are not designed to be centrally managed. It used to be done on Windows 3.11 and Win9x using Novell Netware, but I have not seen that being used anywhere for many years.

  • You'll be hard pressed to find compatible drivers.
    – surfasb
    Jul 1, 2011 at 20:56

As Shinrai points out in the comments to another answer, Home versions of Windows don't support Group Policy, so it's simply impossible do much of what you're asking on those machines.

The only thing you list that can be done with your setup is Internet filtering, which can be done with Linux server configured to be a transparent proxy. For more information on configuring this, see this answer on Server Fault.

You must log in to answer this question.