Windows Forum

Ask something
Discussion Locked

Locking down XP in a NT Domain

0 helpful
8 replies

by gary5500

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Currently have a NT Domain (which we a upgradin soon) with Win 98 clients. These clients are locked down (no control panel, run, display, etc.) using polices located on the PDC. I amaware that I cannot accomplice the same thing with tose policies on a XP box. However my question is How can I lock down XP Pro for all domain users except admin (without active directoy)?

8 replies

by mwc

On the local PC from run gpedit.msc. This will open the group policy editor. Most everything can be locked down from here. Is a little learning curve if your not familuar with this tool.

by gary5500

Locking down the PC would work if I wanted to do that for everyone that logs on to the PC, however I still need to have full rights if I logon as an Administrator.

by capabel

On the local PC from run gpedit.msc. This will open the group policy editor. Most everything can be locked down from here. Is a little learning curve if your not familuar with this tool.

This is the correct answer, every lockdown option includes to exclude the Administrator. I have setup several machines this way and I'm still able to login as Admin with no lockdowns.

by w2ktechman

yes, group policies do work without active directory. They can be assigned on different levels, with the local machine overriding all other policies (unless a NO OVERRIDE was added from a higher source). At the local machine you can use, set, and administer group policies. To do this go to start -- run -- type "MMC.EXE" and press enter. A console will open. go to file -- add\remove snap-in and add group policies for the local machine.

by cookie_monster

It should still be possible to use poledit for NT to create a policy which has different permissions for different user groups. This will create an NTConfig.pol file but you will have to do a little research into where to put this in order that XP recognises it. It has been a while since I attempted this as Active Directory is by far teh easiest method if they're all on a domain.

This discussion is closed to new replies.