fine grained Windows user permissions

Question

Windows 8 has 2 options for setting account types:

• Standard
• Administrator

I'm looking for a way to make custom account types that have finer grained permission options available. For example I would like control over if a user can:

• which control panel options they are allowed to view/modify
• which external media they are allowed to use (which UUIDs are allowed)
• white list / black list of applications allowed to run (including ones usually requiring administrative privileges)

Answer 1

You don't create a user account that has these permissions, you create Group Policy Objects which have these defined in them. Then, you apply them to Organizational Units in Active Directory that have the users or computers that you'd like them to apply to contained within.