Group Policys

nucleardoctor · 02-02-2007, 03:27 PM

Ok, I have a windows 2000 Advanced Server, and I don't have it config. as a domain controller, basically its a normal computer... I use it to host some of my files. I wanted other people to be able to login to it though the termal, which they can. But I wanted to control what those people can do and what they can't get into. I wanted to prevent them from getting to certain files and also set it so they can't shut down the computer. I was thinking about using GPEdit.msc but that will also make the changes to the administrator account, which I only have a few accounts I need to do this to. Any ideas... I don't want to turn it into a domain controller.

newhouse1390 · 02-03-2007, 10:06 PM

Not sure if this woll work, but give it s shot.

Download the GPMC from MS, see if you can use this to link GPO's to certain user groups. You might have some more questions, let's see if it will work for just the local policies (the GPMC is typically used in large complex domains).

Idealy you would want to create a domain, but from what it sounds like you do not have a very large user base, so it may not be necessary.

removed82807c · 02-04-2007, 01:43 PM

since when do Group Policies (by default) take effect on the administrator account?

nucleardoctor · 02-04-2007, 03:09 PM

When you go to create a new account :-p I don't want it to be an administrator, I want it to be a user that has specific access that I give them. Like if I put in the policy that they can't shut down the computer, I want it to do that so they can't. Or anything else I do. When my computer is a domain controller, I can do that, I can create groups and give policy's but when its not a domain controller, I can't figure out how.

Ok, ill try that way.

newhouse1390 · 02-04-2007, 05:50 PM

Quote:

since when do Group Policies (by default) take effect on the administrator account?

The default policy applies to everyone on that computer or domain. You can link the GPO's to specific OU's (domain) or maybe local users (local).

removed82807c · 02-05-2007, 04:28 AM

That's completely new to me...
and as a test, I just logged in on a test domain here... set to remove the possibility to shut down the computer.
With a user account, I could log out, not shut down.
With the local admin, everything possible.

crazijoe · 02-05-2007, 06:01 AM

Quote:

Originally Posted by yakkeh

That's completely new to me...
and as a test, I just logged in on a test domain here... set to remove the possibility to shut down the computer.
With a user account, I could log out, not shut down.
With the local admin, everything possible.

If you read the first post. The server is not configured as a DC or on a domain.

Domain policies automatically filter out local policies when logging into a domain. You can setup local computer policies for users on the local machine. Admins of the local machine are normally unrestricted when logged in locally.

02-02-2007, 03:27 PM	#1 (permalink)
nucleardoctor Registered User Join Date: Dec 2006 Location: New Jersey Posts: 15 OS: Windows XP Professional	Group Policys Ok, I have a windows 2000 Advanced Server, and I don't have it config. as a domain controller, basically its a normal computer... I use it to host some of my files. I wanted other people to be able to login to it though the termal, which they can. But I wanted to control what those people can do and what they can't get into. I wanted to prevent them from getting to certain files and also set it so they can't shut down the computer. I was thinking about using GPEdit.msc but that will also make the changes to the administrator account, which I only have a few accounts I need to do this to. Any ideas... I don't want to turn it into a domain controller.

02-03-2007, 10:06 PM	#2 (permalink)
newhouse1390 Member, Networking Team Join Date: Jan 2005 Location: Ohio Posts: 1,040 OS: Windows Server 2003	Not sure if this woll work, but give it s shot. Download the GPMC from MS, see if you can use this to link GPO's to certain user groups. You might have some more questions, let's see if it will work for just the local policies (the GPMC is typically used in large complex domains). Idealy you would want to create a domain, but from what it sounds like you do not have a very large user base, so it may not be necessary. __________________ Because you can read this thank a teacher, because it's English thank a soldier.

02-04-2007, 01:43 PM	#3 (permalink)
removed82807c Registered User Join Date: Jan 2007 Posts: 42 OS: ******* WINCRAP	since when do Group Policies (by default) take effect on the administrator account?

02-04-2007, 03:09 PM	#4 (permalink)
nucleardoctor Registered User Join Date: Dec 2006 Location: New Jersey Posts: 15 OS: Windows XP Professional	When you go to create a new account :-p I don't want it to be an administrator, I want it to be a user that has specific access that I give them. Like if I put in the policy that they can't shut down the computer, I want it to do that so they can't. Or anything else I do. When my computer is a domain controller, I can do that, I can create groups and give policy's but when its not a domain controller, I can't figure out how. Ok, ill try that way.

02-05-2007, 04:28 AM	#6 (permalink)
removed82807c Registered User Join Date: Jan 2007 Posts: 42 OS: ******* WINCRAP	That's completely new to me... and as a test, I just logged in on a test domain here... set to remove the possibility to shut down the computer. With a user account, I could log out, not shut down. With the local admin, everything possible.