[arstacey]

I would like to be able to completely lock down a computer so that only those programs I specifically allow can be run. I want ot be able to prevent access to basically everything except internet explorer , remote desktop, and microsoft office. Does anyone know of a program that will allow me to do this?

It would be great if I could have a faux desktop where the only thing available are the items I choose. (maybe just some shortcuts ot the programs I want others to have access to)

 

[BMR777]

It depends on whether you are running Home or Pro. If you are running Pro, yes you can easily do this. Same for Windows 2000 Pro.

To do this, go to start>run> type "gpedit.msc" without the quotes. The Group Policy Editor will appear. Play around with the different sections. Either under "Computer Config or "User Config" there is a spot that lets you adjust Windows so that only specified programs will run. Make sure to add gpedit.msc to the list if done in computer config, otherwise you will not be able to reverse this. If you are doing this under User Config, and you have two accounts (Admin and Lockdown), you will need to temporairly give lockdown acct admin rights and log in using lockdown and adjust the gpedit tool while in lockdown acct. When done, log back in as admin and give lockdown a limited acct again. The policy is in there somewhere, I just can't remember where.

Hope it helps
BMR777

 

[Resolution]

This can mostly be accomplished with the Group Policy Editor if you have Windows 2000/XP. All you would have to do is create a list of allowed applications such as "winword.exe", "iexplore.exe", "mstsc.exe", etc. You can remove all the desktop icons that you can from the user's desktop (except the programs you allow) because they will no longer be functional.

Now the only problem with this is that the policies are system-wide and they will affect all users on the computer (including the Administrator). Luckily, Microsoft's Knowledge Base has an lengthy explanation on how to fix it so that the Administrator is not affected by the policy changes.

The policy is in there somewhere, I just can't remember where.

Sorry, BMR777. I didn't realize that you had made a reply. The policy is located at "User Configuration\Administrative Templates\System"