Desktop

Ask something
Discussion Locked

locking down

0 helpful
12 replies

by jsolari020

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am running windows xp home edition at home..I ave 2 accounts set up..one is the admin which is me and the other for the rest of my family is not an admin..my siblings continue to mess things up..is there anyway i can lock this machine down so that they cannont change the background, install stuff, etc... It would be of great service if someone could help

12 replies

by oz_media

As administrator it is up to you what access rights they have. When setting up the users you are asked to select what type of user you wish the account to be for. Guest access for example will offer most of the restrictions you need.

You can modify the existing user account file access through the Control Panel>User Accounts applet. You will have Group Memberships with default levels of access or you an customize access as needed.

by mark

If they are logging in with their own name and password, they should not be affecting your login side. Make sure you setup a password for yourself that they do not know. Then be sure to have a screensaver password and try to log off when you are done. They should only be able to login on their name/pw and only change their settings. Usually you setup multiple accounts for each user.

by my_hood_welded_shut

security starts with the Admin. Every time you walk away, log off. Only have your account, and the guest account. If you decide to allow someone else access, set up their account for them. Be sure the accout is a "limited" account. The user may be able to change his or her personal desktop settings, but that should be the extent of the damage.

\james\

by curacao_dejavu

ok,
they are not admin.
make them normal user (not power users) so in theory they can not install stuff.
this depends also of the program itself if it follows the policy of microsoft to let only administrators install programs.

next.
regarding desktop, etc, your best (free) bet is the tweakui utillity of microsoft, (found at the power toys section)
http://www.microsoft.com/windowsxp/pro/downloads/powertoys.asp

Leopold

by donmars

This is the reason for operating systems like XP, 2000, NT, Linux but not 98. You as Administrator will have total control over what users can do or go with the operating system. You will be able to grant rights and permissions to individuals that are discriminating among them. So the more trusted user can have greater freedoms. This is a somewhat complex and vast area and I would suggest you do a little reading and studying to get the most out of your OS. This is part of what Administrators do for 70K to 125K per year, though a small part. This stuff is well worth learning, invest in one or two good books. You can do all types of stuff such as remove the "SETTINGS" button, prevent changes to the desktop, prevent program installs etc. There are too many involved things to do to tell you what to do step by step here. You have to define on paper (a plan) exactly what you want to be able to prevent or allow and go about configuring the OS. Some site to get you started are:

http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q304/0/40.ASP&NoWebContent=1

http://www.i386.com/

You are probably interested in Mandatory User Profile where When a user is assigned a mandatory profile logs off from a computer, any changes to the profile are lost.
http://support.microsoft.com/?kbid=307800#1

http://www.blackviper.com/WinXP/servicecfg.htm

http://www.tweakxp.com/

Good luck and happy locking down!

by donmars

STAY IN CONTROL WITH MANDATORY PROFILES
administrators define the settings and lock them down to prevent users from making modifications. For example, say you want complete control
over all computers and settings. You demand a blue background, five icons on the desktop, five programs on the Start menu, and the taskbar placed on the upper side of the screen. While you can configure these settings via the profiles, users can still change them.

To help you stay in control, Microsoft implemented mandatory profiles, where administrators define the settings and users can't permanently change them. With mandatory profiles, even though the users can alter
the settings, the computer won't save the changes after the user logs off.

You can "convert" an existing profile to a mandatory profile by
renaming the Ntuser.dat file to Ntuser.man. When the user logs on, he or she will then have a mandatory profile, and the computer can't save
any changes he or she makes to the environment.

Mandatory profiles are useful when you want to assign the same settings to several users. Instead of creating a profile for each user, you can create one profile, change it to a mandatory profile, and assign it to multiple users.

There's a catch to using a mandatory profile. If it isn't available, the user can still log on because the system uses the cached information. To prevent users from logging on when the mandatory profile isn't available, add the .man extension to the profile folder.
For example, if the mandatory profile is \\server\share\mandatory,
rename it to \\server\share\mandatory.man.

This discussion is closed to new replies.