Protecting System files

Try restricting security on winnt folder. Give users only Read and List access. Try that and see if it works.

If you're using a windows 2000 infrastructure including Active Directory you can use group policies. These group policies can be applied to certain users (users in an OU/workstations in an OU). With these group policies you can restrict the user, for example: disallow software install/remove;disallow control panel;access to filesystem/hide drive C: from the explorer etc.etc.

There is a product called Deepfreeze. www.deepfreezeusa.com
This is a great product. A user can delete every file on their PC and when the pc is restarted the pc returns back to the state it was in when it was "frozen". As long as the user saves all of there files to a network share, or a local partition that is not "frozen" there files will be safe. This product also a great anti virus tool since any virus infection will be gone the next time the pc is rebooted. I purchased it for the same problem you are having (with public access computers) Group policy locks down a workstation to a good extent but it does have it's shortcomings, and the ability for users to access and delete files is one example. As far as your problem of users installing software on their 2000 boxes, unless you have them in the power users or local administrator groups, they cannot install software.

I noticed in the control panel a tool called Users and Passwords. Here I can setup the user with different levels of access eg Administrator, Power User, Restricted User etc... I have selected Restricted User which quotes 'users can operate the computer but cannot install programs or make any potentially damaging changes to the system'.

I've found programs can still be installed and system files can still be deleted. I wonder if anyone else has come across the same thing?

You will have to go to each computer. Go to start>run and type in MMC. This will start the Microsoft Management Console. From here, go to Console>Add/Remove Snap-in. Add the group policy snap in and make sure it is for the local machine. From here, you can hide the system directory, and stop all installations from happening without your permission. If you need anymore help, email me at: jwhitlock@starprecision.com and send me a number where I can contact you and I'll walk you through it. Thanks and I hope this helps, Jeremy

With deepfreeze the user can delete the ENTIRE Winnt directory and once the PC is rebooted it will be back again - I urge you to try the demo
you will be amazed at the product

This question was closed by the author