registry lock for desktop

We are using a program called WinLock Pro in our office right now. It is a pretty simple, straight-forward program that allows you to lock it down pretty heavily.

However, you may find group policies a little more flexible. I am working right now to write my own program that will lock down the desktops, but unlock registry options through a small desktop program with a password.

If you are uncomfortable with MMC or the registry, try something like WinLock.

If you are on a Windows 2000 Domain then use one of the GPO's. If you have using a stand alone installation, then your best bet is to take the user out of the local adminsitrators group and make them ordinary users. It is possible to use gpedit.msc to accomplish this but if you are not in a domain then it is not a good idea to do that.

It's also possible to manually set the ntfs permissions on regedit.exe and regedt32.exe to exclude the users in question. Be very very careful, because an administrator can lock himself out easily. Do not set permissions for groups. For example if you set the users group to deny access, then the adminsitrator will not have access either, because the administrator is a member of the users group and deny permissions take precedence over others.