Networks

Ask something
Question Locked

Need to lockdown XP Client on NT4.0 Server Domain

0 helpful
8 replies

by rchan

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Company I work for has a NT 4.0 Server Domain running Windows 95 and 98 stations. Recently we needed to add 30 more machine to our business and we got new XP machines.

Any way to lock these systems down and have our customized desktop and start menu for every user in a particlur group??? Currently we are doing this with our Win95/98 machines.

8 replies

by scott_heath

You should be able to use one XP system, create a local policy that does what you want using gpedit.msc, then copy the policy to the other PCs. The policy is located under c:\windows\system32\grouppolicy.

If what you want to do isn't to difficult you may be able to use a series of registry files to import the needed changes directly into the registry as well.

Let me know how it goes.

by maniacman

and I doubt that the old .pol files will work on XP clients, as they expect to have GPOs' applied to them via AD. This will require local policies, which kinda sucks because you have no central control over them.

by scott_heath

GPO's are really just registry keys. It's not as easy as having actual Domain level policies but it should work.

by rchan

If I can create a *.reg file and have a *.bat file to run that reg file during the logon process when a particular group of users login, it should apply those changes to the system and should go away when logged off? If anyone is intrested I can send a copy of the *.reg file I have now and see if that would work.

by scott_heath

It's that simple. I've never tried it as I have been using an AD environment since pretty much Windows 2000 Server first came out. I can't even remember when the last time I saw an NT4 box was!

Post the contents of your reg file and we can take a look.

by rchan

REGEDIT4

;Disable Control Panel Access
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoControlPanel"=dword:00000001

;Force Control Panel to Classic View
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"ForceClassicControlPanel"=dword:00000001

;Hide Set Program Access and Defaults in Add/Remove Programs
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall]
"NoChooseProgramsPage"=dword:00000001

;Disable Control Panel Access
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispCPL"=dword:00000000

;This restriction removes the Control Panel, Printers and Network Connection settings from the Start menu.
;If the Taskbar settings are also hidden it causes the Settings menu to be completely removed.
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSetFolders"=dword:00000001

;Disable right click on taskbar
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoViewContextMenu"=dword:00000001

;Disable Save Desktop Configuration on exit
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSaveSettings"=dword:00000001

;Show IE Icon on Desktop
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoInternetIcon"=dword:00000001

;Hides My Documents on Desktop
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\ShellFolder]
"Attributes"=dword:0xf0500174

;Enable/Disable Notification Area Balloon Tips
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"EnableBalloonTips"=dword:00000000

;Remove Common Groups from Start Menu
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoCommonGroups"=dword:00000001

;
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz]
"NoRun"=dword:00000001

;Enable/Disable CD Burning
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoCDBurning"=dword:00000001

;Enable/Disable IE Photo Support Bar
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Photo Support]
"MyPics_Hoverbar"=dword:00000000

;Manage Internet Explorer Error Reporting
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"IEWatsonEnabled"=dword:00000000

;Change the Registered Organization/Owner of Windows XP
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]
"RegisteredOrganization"=string value:USER Customer Care
"RegisteredOwner"=string value:OWNER
;Automatically Close Applications Not Responding at Shutdown
[HKEY_CURRENT_USER\Control Panel\Desktop]
"AutoEndTasks"=REG_SZ:00000001

;Enable/Disable Task Manager
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000001

;Power Down the Computer After Shutdown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"PowerdownAfterShutdown"=dword:00000001

;Force Hidden Operating System Files
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000000

;Disable System Properties Access from My Computer
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoPropertiesMyComputer"=dword:00000001

;Redirect Desktop Folder
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
"Desktop"=expand_sz:\\joe\profile$\Agents\Desktop

by scott_heath

That the registry entries could change back if the local policy doesn't reflect those items. Even if there is "no" policy, that in itself is sort of a policy.

Try applying the REG file and then running gpupdate /force. IF the entries stay you should be good. If not then try copying the c:\windows\system32\GroupPolicy folder.

This discussion is closed to new replies.