Is there a way to restrict access for specific (non admin) users to cmd, windows tools, explorer on an Wim XP system?

Partially I consider to do this through group policy & logon script 1. deny access to cmd, local disks, registry editor, etc from group policy (allow batch) 2. configure a logon script which for admin users removes this restriction from registry, for non admin users it will not be able to remove restrictions because it does not have rights.

Is there a better and which should also cover more restriction items?


1 Answer 1


If you set restrictions via Group Policy, don't use a registry hack script to unset them. On the next policy refresh, the GPs will reapply and all changes will be lost.

We do this by having two user configuration GPOs, one which sets all of the restrictions for regular users. We then have a second GPO with a higher priority link order and security filtering so that it applies only to administrators. That way, during GP application, the system will apply the appropriate permissions, based on who is logged in.

Remember, only user configuration settings can be done this way (since Computer Settings apply at startup and doesn't evaluate who is logged on)...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.