Re: Info please

"Rabbit" <Rabbit_is@xxxxxxxxxxx> wrote in message
news:3o9bm3F4tv27U3@xxxxxxxxxxxxxxxxx
> "pmj" <post@xxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:lwKTe.104553$G8.59368@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
>>
>> Well, not really a case of not worth the "effort" - cos the whole
>> idea of windoze Group Policy is that it's actually *very* easy to
>> apply all those sort of Policy Restrictions, right across thousands
>> of PCs - Desktops &/or Laptops.
>>
>> What *is* a lot of effort (for the IT people) though, is trying
>> to suss out exactly which out of all the different "Group Policy
>> Restrictions" to Apply, to the Machines they have to look after,
>> so as not to screw things up for most people who Use them.
>>
>> Far better to leave Regedit available (for people who know about how
>> to use it & what it can do) & to have things like the "My Computer"
>> View in windoze Explorer unavailable to the casual (normal?) User,
>> so they can't accidentally Rename, Move &/or Delete stuff.
>
> This might be one of those * I'm sorry I asked* stoopid questions
> but here goes anyway.
> If a pooter is locked down with restrictions and the user can access
> the registry could they in theory alter the restrictions ?

Yep.

If you look up & find out about all that sort of "Group Policy
Restrictions" type stuff, on Pages such as this...
http://support.microsoft.com/?kbid=231289

You'll see that it talks about using all sorts of fancy
"Administrative Tools", which come with things such as Win 2000
& WinXP Professional Edition, (like GPEdit.msc) but they all, basically
just put Entries into the Registry, so you can (even if you don't have
any fancy "Policy Editing" type Administrative Tools), Edit the Registry
directly (when you know what Values to Edit/Create), to either put in
your own Restrictions, or to Remove/Alter Restrictions that have been
applied...

Which you can find out by looking at Pages like this...
http://support.microsoft.com/?kbid=292504

&, of course, on all the various "Tips & Tweaks" type Sites.
Here's a good place to Start...

Security Restrictions & System Policies
http://winguides.com/registry/category.php/4/

Desktop & Explorer
http://winguides.com/registry/category.php/41/

Have a look at them & you'll be surprised at the sort of things that
can be altered.

You can try a few out for yourself & see what they do - many can
actually be very useful!
:-)

Just remember to Edit the Registry back again, when you've finished.

There are literally *thousands* of things, which is why there's no
way any PC can ever be properly Locked down & still remain useable,
yet not be able to be *Un*Restricted.

Obviously, though no (proper) Firm would ever try to rely purely
on windoze Policy Restrictions - they should also have a proper
"Terms & Conditions of Employment", which says what is & what is
not acceptable use of their Equipment (or the Employees time).

HTH

--
pmj


.

Relevant Pages

  • Re: Domain Policy
    ... Never changed so many registry ... keys, specially on the PDC. ... manage Group Policy remotely to undo your changes. ...
    (microsoft.public.win2000.security)
  • Re: Group Policy question
    ... I was wondering why my Group Policy Help section would have directed ... Steve, I asked a question, which is just under this one about an account ... I do know to not mess with the registry ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Custom GPO and suggested settings
    ... You can't change what portion of the registry a particular setting lives in, ... The main difference between a policy ... moves out of scope of a Group Policy the registry ... Policies are generally considered to be 'better' than preferences. ...
    (microsoft.public.windows.group_policy)
  • Re: Group Policy question
    ... Thans to all who responded to my question about group policy and how to ... I do know to not mess with the registry ... able to use it to some degree to lock down the limited account I created I ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Group Policy question
    ... Policies" and Local Security Policy that is a subset of local Group Policy. ... the registry directly unless given direct and cohesive instructions ...
    (microsoft.public.windowsxp.security_admin)