Possible Duplicate:
How to apply group policy settings to specific local accounts in Windows

The internet cafe where I've just started working has just received some new Windows 7 computers. We currently have no Windows Server /Active Directory in place but would like to restrict users from accessing features like changing the theme, accessing control panel etc.

I have tried changing user settings in the local group policy, but policy is applied, it seems to affect the main Administrator account aswell.

Is it possible to to 'lock down' features and settings for standard users without affecting the administrator account using built in Windows functionality?

Or if not, is there any (preferably free or discounted for a non-profit) 3rd party software that could achieve this?


I don't believe this is an exact duplicate of How to apply group policy settings to specific local accounts in Windows

When there's no domain, there are no shared groups or users for all the machines.

You could generate a policy file in the method described, and distribute it manually.

Another method is do generate .reg files containing the equivalent modifications. this link points to documentation of all the group policy parameters, and their equivalent registry key. each setting can apply to users or the whole machine - so you can choose between

  • restricting specific users, but not the administrator
  • restricting the whole machine and disabling these restrictions to the administrator
| improve this answer | |

Create a new group and insert the user that will be in login to it. then change only the group policy.

| improve this answer | |

Just create an Organizational unit an attach a new GPO to it.

| improve this answer | |
  • This only works in Active Directory, which the original poster specifically said they don't have. – nhinkle Mar 9 '11 at 6:10
  • Yes unfortunately I cannot create an OU on a standalone machine, however the answer to superuser.com/questions/134066/… works fine for my needs. One change I made was to apply it to "non-administrators" instead, meaning any new accounts created would inherit the policies – MarcDJay Mar 9 '11 at 16:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.