Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
How to apply group policy settings to specific local accounts in Windows

The internet cafe where I've just started working has just received some new Windows 7 computers. We currently have no Windows Server /Active Directory in place but would like to restrict users from accessing features like changing the theme, accessing control panel etc.

I have tried changing user settings in the local group policy, but policy is applied, it seems to affect the main Administrator account aswell.

Is it possible to to 'lock down' features and settings for standard users without affecting the administrator account using built in Windows functionality?

Or if not, is there any (preferably free or discounted for a non-profit) 3rd party software that could achieve this?

share|improve this question

marked as duplicate by nhinkle, Sathya Mar 9 '11 at 13:20

This question was marked as an exact duplicate of an existing question.

up vote 0 down vote accepted

I don't believe this is an exact duplicate of How to apply group policy settings to specific local accounts in Windows

When there's no domain, there are no shared groups or users for all the machines.

You could generate a policy file in the method described, and distribute it manually.

Another method is do generate .reg files containing the equivalent modifications. this link points to documentation of all the group policy parameters, and their equivalent registry key. each setting can apply to users or the whole machine - so you can choose between

  • restricting specific users, but not the administrator
  • restricting the whole machine and disabling these restrictions to the administrator
share|improve this answer

Create a new group and insert the user that will be in login to it. then change only the group policy.

share|improve this answer

Just create an Organizational unit an attach a new GPO to it.

share|improve this answer
This only works in Active Directory, which the original poster specifically said they don't have. – nhinkle Mar 9 '11 at 6:10
Yes unfortunately I cannot create an OU on a standalone machine, however the answer to… works fine for my needs. One change I made was to apply it to "non-administrators" instead, meaning any new accounts created would inherit the policies – MarcDJay Mar 9 '11 at 16:16

Not the answer you're looking for? Browse other questions tagged .