Over 1 million tech questions and answers.

Local Security Settings & Group Policy

Q: Local Security Settings & Group Policy

Not long ago Soul Invictus loaded winXPpro on the PC and confronted an issue. Thats really not surprising. Issues exist using this, the latest & greatest OS in wide distribution world-wide. It was developed upon previous versions, so it really shouldn't come as a big surprise what it does & to some extent, how it does it. Yet, it still exists with functionality barely defined to the novice user, IMHO.I have XP Professional and I'm getting my bearings on the differences between this version and another XP version. I notice this one has a Windows Firewall. My problem is that I used to be able to access my employer's company intranet from home. When I go to the site and enter my login info I get the message: Access Denied (policy_denied). Your system policy has denied access to the requested URL. For assistance, contact your network support team. I'm thinking I have to modify a setting in gpedit.msc, however I can't be sure. Any thoughts of what security setting that needs to be modified? My thoughts are:Policy information in winXPpro is kinda confusing.Like many, I am the network support team in my household.My thoughts are: "What should I do when contemplating changing a setting".Any changes might best be done knowing first what the default settings are.and where to find them.and how to interpret the information available on the OS about these settings. So, I navigated to the "group policies" that typing gpedit.msc in the "run" will deliver. To the best of my knowledge, all settings are at the default setting. Before doing this, I also navigated to a section I typically use to find "Security Policies". It is among what are considered "administrative tools" and accessed slightly differently. The "administrative tools" panel includes shortcuts to:Component ServicesComputer ManagementData Sources (ODBC)Event ViewerLocal Security PoliciesPerformanceServicesFirst let's try start-->run-->gpedit.msc. Here we find two basic directories with 3 main folders each. Opening them up reveals the organizational tree we get used to seeing in a Windows OS and elsewhere.That appears to me to be... large. A cornerstone of understanding it might be to see what all users share in having this feature. Windows XP Pro tends to strike one as an operating system designed to accomodate users within a range from single user to large corporation users. For this reason I think it is desireable to "filter out" that which is unnecessary for the simpler user & understand what should be done as one advances in the complexities of use. Bearing in mind security issues. (at some risk of having a bucket of water thrown at me and hearing "just stay with the defaults if ya' know whats good for ya'!")To see it from a different angle we'll select start-->control panel-->performance & maintenance-->administrative tools -->local security settings:Five directories are here and moving down the tree, opening each folder as we go...1. Account Policies-->Password Policies2. Account Policies-->Account Lockout Policies3. Local Policies-->Audit Policiesclick for image4. Local Policies-->User Rights Assignmentsimageimage5. Local Policies-->Security optionsimageimageimageand backing up to capture the lost type:imageimage6. Public Key Policies-->Encrypting File Systemimage7. Software Restriction Policiesimage8. IP Security Policies on Local Computerimageand once again, backing up to capture the type that extends past the limit of a screenshot.imageWhere we "backed up to capture the lost type" was the entry: Network access: Remotely accessible registry paths. (#48 of 63 security options). If you right-click on this entry (or any entry) you will get more details by selecting "properties". Here we see why the entry is so long, 10 registry paths are involved.imageWhat does this all mean? I don't know. By having it visible, I do know that it is not invisible. Perhaps we can reference to it as we learn, huh?Hundreds of entries, each bringing about a change possibility. Maybe given time we could discuss them in more depth in this thread, by right-clickin' each line & asking the questions that will inevitably arise, I guess.

Read other answers
RELEVANCY SCORE 200
Preferred Solution: Local Security Settings & Group Policy

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

RELEVANCY SCORE 102.8

Will either of these allow me to restrict drive access to a single user only? I've tried to restrict drive access with Group Policy Editor but it applies the restriction globally--even to me the administrator.

Could anyone let me know if this is possible and how to do it?

Much thanks.

A:Group Policy Editor or Local Security Policy

I take it that you want to restrict access to this drive to everyone but yourself. Which drive are you referring to, is it locally connected or via a network?

Read other 6 answers
RELEVANCY SCORE 100.8

Hello everyone,


I am slowly working my way through Scott Muellers Comptia A+ Cert guide and currently learning about security fundmentals. I have a test rig running XP Pro service pack three.

However when I wanted to go into local group policy to hide specified drives on that computer (as an experiment) I couldn't see anything listed under windows components except media player.

I followed the same route as you would on windows 7, User config-administrative templates-windows components, but there is nothing there. By the way my test rig is not connected to any networks at all.

What did I miss?!

Thanks

A:Query about local group policy settings in XP Pro

We are not here to help you with your homework. How would you learn if we told you? This thread is now closed.

Read other 1 answers
RELEVANCY SCORE 96.4

This is a repost from another forum.. I was directed here..  I have seen all the answers regarding this already..
Still having fits... there has to be a way to do this..


SYSPREP GENERALIZE LOSES LOCAL GROUP POLICY SETTINGS       


I have a laptop in which I've created an image I want to  deploy. 

The image has VERY specific group policy settings to restrict the user from doing anything improper on  the desktop.  I have created users and assinged the LGP to a specific user.  It works fine...

BUT, when I sysprep it and do the generalize pass, all the LGP goes away.  I have an unattend file for win 7 that I've created using the SIM program.  I use it to handle the OOBE stuff.


Bottom line, I have an  image that I want to clone using the MS tools (IMAGEX) to create a WIM and then deploy it to laptops as a WIM image.  I need to figure  out a way to clone this laptop and keep  all the settings and let MS WIN7
be happy with the SID's and computername.  I could do this in WINXP and WDS easily.  But WIN7 is a little more difficult.

the LGP is used to lockdown the laptop.  These laptops are for police and fire, so I want them to boot to a user (autologin) and then allow them to login to the dispatch application.  It works with no porblems until I sysprep  it for deployment.

Anyone have any ideas.... my thoughs are no because the LGP is tie... Read more

A:SYSPREP GENERALIZE LOSES LOCAL GROUP POLICY SETTINGS (repost from other forum)

Hi,
Based on my research, we can configure local Group Policy Administrative Template settings on a master computer. This is because Administrative Template settings are stored in the registry, and Sysprep does not change this part of the registry. Any changes
you make to Administrative Template settings will appear on the disk image.
And the sysprep does not remove the user specific GP. It is still under ?c:\windows\system32\Group Policy Users". As you said, the user SID changed during sysprep. Try to change the name of the policy folder in the "c:\windows\system32\Group Policy Users"
folder to match the users new SID.
And then run GPUPDATE / FORCE, restart again.
Regards,Ada Liu
TechNet Community Support

Read other 2 answers
RELEVANCY SCORE 93.2

Hello Seven Forums,

So I was trying to disable the 'Network Access: Do not allow storage of passwords and credentials for network authentication' since it was enabled which meant I couldn't save passwords. When I right clicked it and opened properties, the options of enabled and disabled were grayed out. Also, there is a padlock on the icon of the Security Settings tab and so does its subtabs. I am on an administrator account but it still doesn't allow me to change the settings. It would be awesome if someone can provide me all the possible solutions; done on Registry Editor would be preferable.

Thanks!

A:Cannot change settings of the Group Policy - Security Options

Well I was going to but looking at your specs I don't have the security clearance needed.
Do you still have the domain problem you had here.
Registry Values Resetting After Connecting To A Domain

Read other 3 answers
RELEVANCY SCORE 88.4

Hi all
For the past 6 months we have received reports of PC's taking up to an hour to get to the login prompt.
All our PC's are running Windows 7 32/64 Bit.
The message is always "Applying Group Policy Local Users and Groups policy"
Once it gets to the login prompt they will login with no problem.
I have enabled GPO logging on 1 PC and the results show as below (sorry for the wall of text) Boot time was 15:16.
I was hoping someone else had come across this issue and maybe has some insight
Network team say "its not the network"!!
Server Team say "Its not DNS or Group Policy" !! 
So its been left with me on the desktop team to diagnose the fault
Regards
Paul Griffiths - NHS Trust in Bristol

GPSVC(534.75c) 15:17:14:459 ProcessGPOs: -----------------------
GPSVC(534.75c) 15:17:14:459 ProcessGPOs: Processing extension Group Policy Local Users and Groups
GPSVC(534.75c) 15:17:14:459 ReadStatus: Read Extension's Previous status successfully.
GPSVC(534.75c) 15:17:14:459 CompareGPOLists:  The lists are the same.
GPSVC(534.75c) 15:17:14:459 GPLockPolicySection: Sid = (null), dwTimeout = 30000, dwFlags = 0
GPSVC(534.75c) 15:17:14:459 LockPolicySection called for user <Machine>
GPSVC(534.75c) 15:17:14:459 Sync Lock Called
GPSVC(534.75c) 15:17:14:459 Writer Lock got immediately.
GPSVC(534.75c) 15:17:14:459 Lock taken successfully
GPSVC(534.75c) 15:17:14:459 ProcessGPOList: Entering for extension Group Policy ... Read more

Read other answers
RELEVANCY SCORE 88.4

Hi Team,
Please let me know what is the standard Setting for below Security Setting ( Audit Policy ), which are followed in most of the Company.

For Eg:- Should i set ' Success & Failure ' for ' Audit account logon events ' & for ' Audit account management' etc...




Thanks & Regards,
Param
www.paramgupta.blogspot.com

Read other answers
RELEVANCY SCORE 84.8

I have an SCCM Client deployed to several test PC. The client configures LGPO directing the PC to receive Windows Update from our SCCM server.  However, it fails. WUAHANDLER.LOG shows the following errors:
Enabling WUA Managed server policy to use server:http://xxxxx.xxx.net:8530
Waiting for 2 mins for Group Policy to notify of WUA polucy chnage...
Unable to read existing WUA resultant policy. Error = 0x80070002.
Group Policy settings were overwritten by a higher authority (domain controller) to: Server and Policy NOT CONFIGURED
Failed to Add Update Source for WUAgent of type (2) and id{{.......}}. Error=0x80040692.
I checked domain GPOs and there is no GPO that would cause this conflict.  I ran RSOP to verify.  What I noticed is that gpresult did not show LGPO as being applied. But when I unlinked all the domain GPOs (linked to the PC OU), gpresult showed
LGPO as being applied.
Any ideas or suggestions welcome.
 

A:Group Policy settings were overwritten by a higher authority (domain controller) to: Server and Policy NOT CONFIGURED

Hi,
 
For this issue, please try to refer to the following article;
 
Troubleshooting Group Policy Configuration for Software Updates
 
If this issue persists, for a better support service, please kindly post at the SCCM forum for further help:
 
System Center Configuration Manager Category
 
Alex ZhaoPlease remember to click ?Mark as Answer? on the post that helps you, and to click ?Unmark as Answer? if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Read other 4 answers
RELEVANCY SCORE 80.8

I have created three user accounts on my computer. Admin, Maint and operator...added the operator account to the group policy snap-in with very restricted policies. Problem is I have somehow associated the Admin and maint as well, how do I reset the local group policy back to default settings? I need to recover the admin capabilities to make changes to the computers.

A:local group policy editor

Hi..JOEYGE... Welcome to SF...Check this link. Hope it helps.

Local Group Policy - Reset to Default

Read other 9 answers
RELEVANCY SCORE 80.8

I've an WinXP SP2 box that I locked down using the Local Group Policy MMC but I need to know if I can selectively lock down accounts manner. I'd like to lock down all the accounts save the local admin account. Thanks in advance!
 

Read other answers
RELEVANCY SCORE 80.8

So In all my searching I can't really find a workaround for this. I have a domain and plenty of domain users but I have one department that remains local user accounts. All I want to do is set the default homepage for these 47 domain connected machines.
So with domain users I can use loopback policy to apply the user gpo settings to any computer in those specific OU's.  But that simply will not apply to local accounts.  Any other thoughts on how to make this work centrally?  Not super interested
in doing one by one.
thanks in advance.

Edit: I did try pushing a registry setting via the computer config but doesn't seem to be taking.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
?Start Page?=?http?

Read other answers
RELEVANCY SCORE 80.8

I have a large network of about 500 machines on a domain. I have set up a local account for exams, with a special local Group Policy that is for non-administrators. The group policy restricts almost everything apart from a few applications.

I need to copy this GP over to another 20-30 machines. Is there any way i can do this.

Copying %systemroot%\system32\grouppolicy didn't work.

A:How to copy local Group Policy?

Welcome to Sevenforums theslowminded!

After you copied the policy over, did you force the update?


Code:
gpupdate /force

Read other 4 answers
RELEVANCY SCORE 80.8

Hi, I have a local group policy on Vista x64 that is not running. This script runs fine on every other OS. W2K > Win7 (including x64 machines) It is a machine policy and it will not run. It is a script that runs bginfo from the Program Files folder. Any ideas? Thanks

A:Local Group Policy Not Running

Hi,

What version of Vista is this? Is it Home Premium, Home Basic, Business Basic, Business Premium or Ultimate (or other)?

Go into Services, and check for the "Group Policy Client" service. You cannot (easily) stop this service, but make sure it is there and running.

Richard

Read other 8 answers
RELEVANCY SCORE 80.8

Hello, I'm using window 7 home. So i dont have local group policy. I want to stop user other than "admin" myself to enter control panel. Anyone know to do it manually? I know there is a way to do it manually with regedit at user setting but not sure how. Or is there any software that does the same thing as local group policy of pro--enterprise edition of window 7?
 

A:Window 7 local group policy

http://www.tweaknow.com/powerPack.php

slight cheating way around it i suppose, go to windows secrets control panel custom etc etc etc
 

Read other 3 answers
RELEVANCY SCORE 80.8

do u know how to configure group policy so once user logs in,he can be assigned local administrator rights.

I wants the moment user logs in a new computer in a domain,in their user configuration
they will automatically assigned local administrator rights rather than I am using contol panel to add manually.
 

Read other answers
RELEVANCY SCORE 80

Hi to all,

when i open Local group policy but not open properly and show message fail to open Local group policy on this computer..........

how to solved this error........ Please Help me!!!

A:fail to open Local group policy

hi and welcome..

Make sure you run as administrator for permission.

Read other 9 answers
RELEVANCY SCORE 80

I have been trying to open the Local Group Policy editor as I need to check the "Lock pages in memory" option in order for a PS2 emulator to work.

I can find the file when searching in my computer but when I open it it says it cannot create the MMC span-in. I have tried to add it to the MMC by clicking on file and Add/Remove snap-in, but when that box opens the 'Group Policy Object Editor' doesnt exist on the list of items.

I am really confused and cant work out why it doesnt seem to exist or work on my computer.

I am running Windows 7 Home Premium.

Thanks for your help

A:Can't find Local Group Policy editor

Welcome to the forum,

Group Policy editor is not available on home premium.

win7 home final - no gpedit.msc?

Read other 2 answers
RELEVANCY SCORE 80

Hi

In all editions of Windows 8, there is the local group policy editor? If so, how do I find it?
Thanks

Bye

A:Find the local group policy editor

Open Run box & type in:

gpedit.msc

& click OK.

I know it's available in the Pro version.

Read other 4 answers
RELEVANCY SCORE 80

Hi !

Windows 7 group policy

I've read a lot of post on this topic but haven't been able to find a clear answer to this question.

Is it possible to create different policies on a local machine and somehow assign these policies to the groups logging in on this machine ? Seems to me that changing the group ploicy affects all users.

The machine is not on a network. It is a computer for test purposes in the field not having a domain server to handle the group policies.

Kind regards

A:Group policy on local machine not on network

  
Quote: Originally Posted by kahr


Hi !

Windows 7 group policy

I've read a lot of post on this topic but haven't been able to find a clear answer to this question.

Is it possible to create different policies on a local machine and somehow assign these policies to the groups logging in on this machine ? Seems to me that changing the group ploicy affects all users.

The machine is not on a network. It is a computer for test purposes in the field not having a domain server to handle the group policies.

Kind regards



Gpedit does change group policies, and all users in that group are affected. I am a little confused as to what you want to do to the users.

Read other 4 answers
RELEVANCY SCORE 80

dir sirs

i have a big problem in my netword
i changed the server and i get a new one
when i log in by local administrator in cients to jion the computer to the new domain
the local administrator is logged in efficted by the a user group policy
i have windows2000 advanced server

so i cannot see the desktop and i cannot join the pc to the netword
any help plzzz
 

A:why local administrator efficted by group policy

From what I understand, you are trying to join client pc's to your domain using the local admin accounts on the client. Is this correct?

When changing from workgroup to domain it will bring up a window asking for a username and password. Since the client is not yet on your domain, if needs authentication to join said domain from an authorized user account (domain admin account).
Enter the domain name first, then with a "/" without quotations, then a domain admin account name in the username field. Enter the domain admin accounts pw in the password field and hit ok. After a minute or so you will receive a welcome message.

Here is a simple example:
Domain: potatochips.com
Domain Admin Username: potatochipeater
pw for that account: ilovepotatochips

So, in the box that comes up enter the above information as so.....

Username: Potatochips/potatochipeater
Password: ilovepotatochips
I hope that this info has helped you. Please reply if you have any other questions.
 

Read other 2 answers
RELEVANCY SCORE 80

Hi, I have a question about the Local Group Policy Editor. I know you can either enable or disable things for all users but is there any way to enable or disable things for only a certain user group (either Standard Users in general or a customized user group created in the Local Users & Groups Editor (lusmgr.exe). For example if I want only a certain user group to be able to lock the computer, in the Local Group Policy Editor I can enable that so no-one can lock the computer but I want admins to be able too etc.

I would love it if someone could answer my question soon

Thanks
Daniel Callaghan

A:Local Group Policy Editor Question

Secpol.msc / Local Policies / User Rights ? This won't stop them from logging off...
But this will: Start Menu - Enable or Disable Log off

Read other 9 answers
RELEVANCY SCORE 80

I want to disable the default reboot after Windows runs unattended updates as this often prevents my overnight backup from running.

I have tried using the gpedit.msc routine to access the Local Computer Policy Editor but apparently that does not work in Win 7 Home Premium which I have.

Is there a manual way I can disable the reboot function?

A:Can't access Local Group Policy Editor

Hello Franco, and welcome to Seven Forums.

The Windows 7 Home Premium edition doesn't include the Local Group Policy Editor. However, you can use OPTION ONE in the tutorial below to disable the automatic restart for Windows Updates instead.

Windows Update - Enable or Disable Automatic Restart

Hope this helps,
Shawn

Read other 5 answers
RELEVANCY SCORE 80

When I run the Local Group Policy Editor an error box appears telling me that Resource '$(string.VerMgmtAuditModeEnable)' referenced in attribute displayName could not be found. File C:\windows\PolicyDefinitions\inetres.admx, line 1495, column 249.
This occurred after a clean install of Windows 8 then download and update to Windows 8.1. I have done two installs and updates to Windows 8.1 and still the problem persists. Any help in solving this, as it is annoying me. Thanks.

A:Local Group Policy Editor Error.

Hi harrycat310,
Please take the following steps to fix this issue:
1. Visit the following link and download the Administrative Templates (.admx) for Windows 8.1 Update and Windows Server 2012 R2 Update
http://www.microsoft.com/en-hk/download/details.aspx?id=43413
2. Install the msi and replace the folder C:\Windows\PolicyDefinitions
with the folder PolicyDefinitions created by Windows8.1-Update-ADMX.msi.
3. Please backup the folder C:\Windows\PolicyDefinitions before the replacement.
Best regards,
Fangzhou CHENFangzhou CHEN
TechNet Community Support

Read other 18 answers
RELEVANCY SCORE 80

Hi all,

I am currently locking down a PC for a client of mine. PC is used as a DMZ, used by the public only to access the internet. PC runs Windows XP Pro SP2.

While configuring the Local Group Policy through gpedit.msc (or through mmc - add/remove snap-in ...) I realised that while applying policies at the "User" level, the administrator account also inherits these policies. Sames goes if applied at the "Computer" level, but that goes without saying.

Luckily I was not applying them directly to the PC in question, rather applying local policies through a VMware session on my laptop, just in case something like this happened.

My question is how can I apply strong Local Group Policies on a PC WITHOUT the administrator account inheriting them?

I tried setting "Deny" permissions on the C:\WINDOWS\System32\GroupPolicy folder, but to make changes to GPO's you need access to this folder. I did work though!

I should also say that this PC is not joined to the Domain and is on a separate subnet to all other PC's.

Any help would be apreciated.

Cheers
 

A:Local Group Policy question (WinXP Pro)

This is a very knowledgeable site BUT, if you receive no answer here, these people are very often quite helpful with Network stuff;

http://forums.windrivers.com/index.php?

gl


 

Read other 6 answers
RELEVANCY SCORE 80

Can anyone advise me on how to open the Local Group Policy Editor in Windows 8, because typing GPeditor.msc in the run prompt doesn't work. I've looked online for an answer but wasn't able to find anything helpful. I would like to make a change to the boot time from here, but for the life of me, can't figure out how to get into it. Please help.
Thanks
 

A:Solved: Local Group Policy Editor

Read other 14 answers
RELEVANCY SCORE 80

Hey all, stuck against a bit of a wall, here. I have a bunch of vista computers and I need them to automatically map a network drive whenever the user logs in.

In the past, we've used a login script and a .bat file to create the shares. But we're getting ready to switch over to vista, but the login script doesn't work under vista.

I've heard that its better to use Group Policy for this, but I cannot figure out how to do it using LOCAL GROUP POLICY. I've found about 100 or so guides for doing it using active directory/serverside things, but we're not on active directory, so that's not an option.

I'm sure there is a policy somewhere, can anyone direct me to it?

A:Local Group Policy to map a network drive?

When you map a drive on the workstation, and put a check in the box Reconnect on Logon (sign-in) it will reconnect every time.

Read other 3 answers
RELEVANCY SCORE 80

Howdy

I was going through some steps to lock down my Windows 10 machine and I have come across the following in Local Group Policy:
Enumerate administrator accounts on elevation - this sounds like a really good idea but when I set it to "Disabled", when I try to run (say) regedit as an elevated/admin user I get prompted to type in my username/password but no option to use PIN as an option? Is this possible?
Require trusted path for credential entry - I already have UAC turned up to the max setting and login with a SUA, is there any further benefit to enable this setting? If I enable this setting I have to click through the following two screens before I am prompted with the UAC prompt to enter my password or PIN:



3. Disable or enable software secure attention sequence - I'm tempted to enable this option and set it to "None" in the drop down box:


Is there any risk/downside to doing this?

4. Boot-start Driver initialization Policy: I'm also tempted to set this to "Enabled" and then set the option in the drop down box to "Good only":


Hopefully this doesn't brick my machine! I have UEFI and Secure Boot enabled.

Are the above good options to enable to further lock down a Windows 10 machine?
 

Read other answers
RELEVANCY SCORE 80

Here's my situation. I've got a computer that's shared by several people (in a small church library), which I'm trying to lock down in a controlled fashion.

The system is running Windows XP Professional. In addition to the administrator account, I've created one restricted account for the librarian, which is password-protected, and one restricted account with no password for everybody else. It's a stand-alone computer -- no domain, no domain controllers, no active directory.

I've successfully implemented a local group policy which prevents users from doing things like changing screen resolution, screen saver settings, etc. But I'd like to have this restriction apply only to the one "everybody" account, and not to the other accounts, and I haven't been able to figure out how to do this. Is it possible? What are the steps involved?

Thanks,
Tom

A:Local group policy -- how to select users?

Hello, Tom, and welcome to TSF. If the "open to everyone" account is used by really numerous individuals, of varying levels of IT competence, then I would strongly suggest you take some time and have a look at a utility provided gratis by Microsoft, the Shared Computer Toolkit for Windows XP. Invest some time to browse all the area I've linked for you, and please post back if you really think this is what will effectively help you keep this computer under your control, your way, all the time.

Read other 3 answers
RELEVANCY SCORE 78.8

Trying to restrict non-admin users from seeing a lot of programs under the Start Menu. Already using the GPO for non-admin users and I'm hoping there is an area I can achieve the above. So the idea is admin account sees all the programs as normal, non-admin user restricted to only seeing a few programs on the Start menu. Can I achieve this through local group policy and if so where

Thanks

A:Local group policy start menu programs

If this is for a home, then it would be simpler to move the shortcuts from all users start menu* to the admin profile(s)**. However, hiding the shortcuts by moving them or via GPO (if there is a way to do that) would not stop users from starting the program via the Windows (file) Explorer.

GPO can restrict a user from running a program. In theory, this should work no matter how the user attempts to run the forbidden program. In reality, they are ways to start some programs restricted by GPO. That is why I wondered if this is for a home - then we might be talking about adults vs. children.

*C:\ProgramData\Microsoft\Windows\Start Menu\

**C:\Users\username\AppData\Roaming\Microsoft\Windows\Start Menu

Read other 9 answers
RELEVANCY SCORE 78.8

I want to disable auto run and auto play of my disk drives for security. To do that, I need to access my Local Group Policy.

However, while logged into my regular account, I am unable to access the Local Group Policy Editor via the gpedit.msc file.

I get a "You don't have permission to access this file" error message.

I don't even have the joy of a UAC prompt. : (

I have Win 7 Pro and am the only user and owner of my computer.

Do I have to get into my admin account and change the settings from there?

A:Unable to open Local Group Policy Editor (using Win 7 Pro)

See if these tutorials help:

AutoPlay - Enable or Disable

AutoPlay - Turn On or Off

AutoPlay - Enable or Disable for Non-volume Devices

AutoPlay Shortcut - Create

Autorun.inf Files - Completely Block

Read other 1 answers
RELEVANCY SCORE 78.8

Hello there,

I have learnt creating policies files from this tutorial.. Now I am facing problem searching and configuring different policies.
1. I dont want 'student' to be able to create files/folder in c: drive.
2. I dont want 'student' to have access to the Internet.

Regards.

A:Let us apply a simple local group policy together in Windows 7.

right click C: drive. select share with / advanced permissions / select advanced sharing and remove student from the list.

Read other 2 answers
RELEVANCY SCORE 78.8

I have some Windows 7 PC which are not in a domain, I need to disable the ability for any user(Inc. Admins) to change the time of these PCs. The setting for this is:
"Computer Configuration / Windows Settings / Security Settings / Local Polices / User Rights Assignment / Change the system time"
How can I do this from the command line so I can put it into a script? If there isn't a way to control gpedit from the command line, is there a registry key I can change to get the same result?
 
Thanks

Read other answers
RELEVANCY SCORE 78.8

I recently locked down a PC's with LGP. It is heavily restricted for public use.

One strange problem that has cropped up is the Flash player in Firefox.

I didn't install the plug-in before I locked down the user account.
Afterwards I realized I hadn?t installed it so I logged on to the Admin account and installed the plug.
The player now works fine when logged in as Admin or as a User with full privileges but won?t play in my locked down user account, where I still get a message saying the plug-in is not installed.

Any ideas what?s going on here or what I might have done in LGP?

A:Local Group Policy and Firefox plugins (Flash)

It doesn't work because the LGP is in effect. Since you added Flash after enabling LGP it makes sense. Just like what you wanted. Say you don't want Flash on the computer for security reasons, but someone tries to install it. It won't work. You need admin account to use it. If you want Flash and LGP you need to undo the LGP, install Flash, and then re-enable LGP.

Read other 1 answers
RELEVANCY SCORE 78.8

Hello,

Does anyone know how to exclude a user from accessing anything on
a local computer , but still be able to use a shared program from that
machine? IE. not be able to see the computer or folder through
my network places or through computer management "shares" folder
or be able to change any settings on the aformentioned machine?
Basically, I want to share a program but not have that user have the
ability to change anything on this "server". It is a peer to peer setup
with XP pro running on all machines. I have tried everything from
sharing and security - but it is my understanding that a Group Policy /
Local Policy should be setup for this machine which would prevent access?

Any help would be greatly appreciated.

graham neil
 

A:Local Group Policy - program excusions for users

How are they going to access it if you take away all the permissions from accessing? I see your quandary. Not sure how you are going to give them permissions to use something that you don't want them to use.

You can deny them local login access to the machine but if they need access to something over the network they have to see it to be able to use it.
 

Read other 3 answers
RELEVANCY SCORE 78.8

I have set some access limits on some programs, but the user that has the limits can run the Local Group Policy Editor and change the settings. How do I prevent access by other users to the Local Group Policy Editor?

Thanks for the help.

A:How do I limit access to the Local Group Policy Editor?

Hello Runandnottire, and welcome to Seven Forums.

The only way to do so would be to change their account type from administrator to standard user.

Hope this helps,
Shawn

Read other 3 answers
RELEVANCY SCORE 78.8

Hi,

I'm not sure where to post this as it's not really a network issue due to the computers not being domained.

At the moment I am applying local group policy settings for each computer (many computers) manually on each machine (Taking about 20 minutes per machine due to the MANY settings that need checking).

Is there any way I can cut this time down by saving a set of policy options from one computer and applying that set to multiple other computers (via a usb stick etc?)

Thanks in advance,

Jack

A:Automating Local Group Policy on non-domain machines?

Hi and welcome to TSF not quite sure but you may find something here Group Policy management for IT pros

Read other 13 answers
RELEVANCY SCORE 78

Dear forum readers,

I know it's possible to configure Wireless settings by policy. However it seems absent from the local group policy, which is where I would like to put it.

How can I do ? Maybe it would work if I copy the corresponding "Wireless Network (IEEE 802.11) Policies" section from a non-local policy template, then import in my local group policy ? I would need such a template though, since I don't know how it looks like.

I'm speaking of the security templates here (the inf files), not the admx files which I have already since I have W10 Pro...

Read other answers
RELEVANCY SCORE 78

I created a policy for non-administrators in Microsoft Management Console. However, I couldn't find a policy to restrict user into a specified folder.

A:How to use local group policy editor to restrict users to Desktop

Exactly what are you trying to accomplish?

Read other 3 answers
RELEVANCY SCORE 78

Hi,
There are systems where users login for general activity and they pile up almost every day. Is there a group policy to delete the local profiles after the user logs off. I came across policies where the profiles are deleted after x number of days or using
delprof.exe or using scripts or remove cached roaming profiles but we do not want to use them.

We want to use only group policies to delete local profiles immediately after the user logs off. Any help would be appreciated.
Thanks,
Nithu

A:Group policy to delete local profiles after user logs off

Hi,
Not Roaming profile? for Local profile, I haven't found a policy to delete it after user logoff, but if what you want to achieve is prevent user saving settings to the desktop, then you can use mandatory user profile instead,.
This profile does not save changes made by the user to the desktop settings. Users can modify the desktop settings of the computer while they are logged on, but none of these changes are saved when they log off. The mandatory profile settings are downloaded
to the local computer each time the user logs on.
http://technet.microsoft.com/en-us/library/gg241183(v=ws.10).aspxYolanda Zhu
TechNet Community Support

Read other 4 answers
RELEVANCY SCORE 78

when i log in my pc on network then it change my local adm password.How i can disable this.pl help me.

A:How to disable local administrator password change group policy

I'm not sure what you mean. Simply logging onto your PC shouldn't change the admin password. It is also recommended to not use the Admin account for general use.

Read other 1 answers
RELEVANCY SCORE 78

Hi,
I was playing around with local group policy with smart card settings, and I checked "Force smart card login". I never set up smart card certificates to be used, and don't have any smart cards for it to work with. I need to login to the computer, but when I try, it says "You must insert a smart card to login". I am using the local administrator account, and tried a few ways to bypass it including;
safe mode
disabling smart card in BIOS
remote desktop

When I go home, I will try using ERD commander, and windows recovery console to stop the smart card service. BTW I am using TinyXP rev.05

Thanks!
 

Read other answers
RELEVANCY SCORE 78

I was setting up local group policies on a laptop so I could apply them to non-admin accounts. Well I goofed and accidentally applied the policies to all users including the admin. The problem is I was restricting access to all programs except a certain few like internet explorer, remote desktop, etc as users will only need to access their webmail and remote desktop to access the terminal server. Now I cannot do anything with the admin profile because the policy was applied to my account as well. What can I do??

A:Accidentally applied local group policy to all user groups

Which Administrator account did you apply this to? The default or did you enable the built-in Administrator account and apply it to that also?

If you didn't go through any steps to activate an admin account previously, you could probably enable the built-in one and change the settings for the normal Administrator account.

Built-in Administrator Account - Enable or Disable

Read other 2 answers
RELEVANCY SCORE 78

I am having this problem that keeps popping up and i've never found out exactly how to fix it.
We use group policy and active directory for all our users but what's happening with this computer is that when you login with the user account everything is restricted (and it should not be). If you try to access internet explorer setting an error message pops up and says it has been restricted. Also if you go into the control panel there is only 2 icons in there. Everything else doesn't show up like Add/Remove programs, Network settings, Administrative Settings, etc.

It is a Windows XP computer, Dell Optiplex GX270

Have any of you run into this before and know of a fix?
Thanks.
 

A:Group policy settings ignored

Read other 6 answers
RELEVANCY SCORE 77.2

Hi ,

I'm struggling for modify local group policy via cmd , anybody knows kindly share your knowledge ,
I can modified local group policy via GUI but i want to modify policy via command line ,
i'm just a beginner in cmd mode , power shell scripting.

#Please refer any guide or book for learning this ,

i want to block wifi-Direct in every client pc via cmdline

I'm waiting for your valuable advice and guidelines
i also searched in google but still i didn't get resolution

operating system : Windows 10 Pro 64
mode : work group
 

Read other answers
RELEVANCY SCORE 77.2

I am working with a Windows 7 Embedded system that is in a workgroup (not on a domain). The firewall rules are specified in the Local Group Policy. Much of the system has been locked down according to DoD standards. The first time the system identifies a
local private network, all firewall rules are applied as expected. After a reboot, only firewalls specified in local settings (the MMC snapin) are applied as seen through the Advanced Firewall Monitoring in the MMC snapin. I can run "gpupdate /force"
to re-apply the rules. However the firewall reverts to local rules after the next reboot. 
The local group policy is configured to not allow local rules. The behavior with this set seems to be opposite of expectations (local is merged, GPO rules are not) but changing this does not change the outcome.
I've reviewed all of the Windows event logs that I know to be applicable, and find little to go on. Any help would be appreciated.

Read other answers
RELEVANCY SCORE 77.2

I'm creating a local group policy to lock down a Win7 Pro Workstation for use in the Staff room.
It's the first time I've used it, previously I've worked a bit with AD. but I've been following on line tutorials and using google and I'm nearly there with it.
But I'm stuck on one thing. My approach has been to remove access to pretty much everything apart from IE, Firefox and Skype icons on the task bar.
I've got the start menu empty apart from the shutdown button, which is what I want but at the top of the start menu is the users icon/picture thing and if i click on it it takes me to "user accounts". I can't for the life of me work out how to get rid of the picture or just stop this happening.

Can anyone help please?

A:How to use Local Group policy to prevent access to User Account settin

Have you tried anything from this thread (especially second page)?

Read other 1 answers