Using policies in stand alone Win2K

Local Group Policy does not allow you to do security filtering or to have multiple sets of Group Policy objects (as do Active Directory?based Group Policy objects). You can, however, set Discretionary Access Control Lists (DACLs) on the folder %SystemRoot%\System32\GroupPolicy so that specified groups either will or will not be affected by the settings contained within the local Group Policy object. This option is useful if you need to control and administer computers used in situations, such as kiosk environments, that are not connected to a LAN. Unlike Group Policy administered from Active Directory, this uses only the Read attribute, which makes it possible for the local Group Policy object to affect ordinary users but not local administrators. The local administrator can first set the policy settings they want, then set the DACLs to the local Group Policy object directory so that administrators as a group no longer have Read access. For the administrator to make subsequent changesto the local Group Policy object, he or she first needs to take ownership of the directory to give themselves Read access, make the changes, and then remove Read access.

Run Poledit. Then open registry. Add a user and double-click on that user icon. Click on "shell" then "restrictions" and put a check mark on "remove run command from Start Menu". Then exit and save. This policy will only affect that particular user.The administrator will still be able to get the "run" command, the other user will not.

This question was auto closed due to inactivity