Windows Group Policy (gpedit.msc)

Group Policies is a powerful area in windows base system where you can control what users can do and cannot do. Unfortunately in windows XP you have a slight problem as all these group policies will apply to the Administrator account as well. Reason behind this is Windows XP dose not support domain users like windows Server versions. Still you can use gpedit.msc or Group Policies to define limitations for users.

How to get control over Group Policies?

Method 1: (Click) Start > (Click) run > (type) gpedit.msc > (Press) Enter
Method 2: (Windows Drive normally it is C) C:\WINDOWS\system32 and you will able to find the gpedit.msc file and double click it.

(Hint) Copy a short cut of gpedit.msc file to your desktop. This will come handy when you play with gpedit.msc file. I will let you know later.

After you open the gpedit.msc windows open go to user configuration and then to Administrative Template folder.

In this I will show you some useful group policy settings you can start with.

Restrict Windows Messenger.

If you do not want your users to use Windows Messenger and you want to block it this is a effective way to do it.

Administrative Templates
Ø (Select) Windows Component
Ø (Select) Windows Messenger
Ø (Double click) Do not allow windows Messenger to be run
Ø (Select) Enable
Ø (Click) Apply
Ø (Double click ) Do not automatically start Windows Messenger initially
Ø (Select) Enable
Ø (Click) Apply

(Hint) Group policies are defined in English. Therefore you can explore through Administrator Template folder and find many useful things you can do to protect your shared computer by enabling the limitations.

These gpedit tricks will come handy if you want to control IE settings.

You can find the gpedit setting in the following location

Administrative Templates
>Windows Component
>>Internet Explorer

Some Interesting Settings

Enable Disable changing home page settings will disable uses changing the home page. First change the Internet Explorer Home page to what you want and enable this.

Enable Disable changing of Auto-Proxy scripts

Enable Disable changing Advanced Page Settings will add more security

Enable Disable changing proxy settings will stop users changing the proxy Settings from IE.

Administrative Templates
>Windows Component
>>Internet Explorer
>>> Toolbars

Disable customizing browser toolbar buttons & Disable customizing browser toolbar will stop users adding or deleting any toolbar buttons or doing any changes to the toolbar.

Administrative Templates
>Windows Component
>>Internet Explorer
>>> Internet Control Panel

Disable the Security page
Disable the Content page
Disable the Connection page
Disable the Programs page
Disable the Privacy page
Disable the Advanced page

These setting will come handy if you want to block someone being changing the Security setting, Privacy Setting and Advance settings for Internet Explorere.

In Windows XP operating system if you change any Windows group policy setting it just apply it to Administrator account as well. Especially if you restrict some access to hard drive partition or Run Command it restrict for Administrator as well. That depends on the setting you apply is a user account policy or machine policy. Normally Machine policy will apply to all the users. You can control user account policies base on users. However, Windows XP dose not support domain users like Windows server versions so even user account policies will apply to all the users.

I am using a simple trick to solve this issue. Not 100% but it makes life easier. In the beginning I just mention to copy a shortcut of gpedit.msc to the desktop. Reason behind that is when you play with Windows group Policies it is very easy to hide or prevent access to your hard drives. You will notice it after you restart your machine. Now you do not have access to gpedi.msc. You might have prevent access to “Run” as well.

Trick 1: If you done something like above situation you can simply solve it by creating a shortcut manually.

Right click on the desktop and go to “new” and select “shortcut”. It will ask you to give a path. If you have prevent access to your hard drive then you will not able to select the path so just select some other target like Desktop and click “Finish”.

Right click on the shortcut that you created and select properties and fill the details for gpedit.msc

Default Values
Target: C:\WINDOWS\system32\gpedit.msc
Start in: C:\WINDOWS\system32\

Click “Apply” and it will create a shortcut for gpedit.msc and now you will able to access gpedit.msc and change Group Policy

Trick 2: Use Trick 1 and before you disable any Program or Hard Drive you can create a short cut in Desktop. It will allow you to access these programs while other uses do not have any access.

Example: Prevent Access to Computer Hard Drives

First create a short cut to the Drives you going to hide or prevent access.
Then open the gpedit.msc [Start > Run > (type) gpedit.msc > Enter]

In Group Policy > User Configuration > Administrative Template > Desktop > Enable the “Remove My Computer icon on the Desktop”

If you need specific driver to be hidden you can go to In Group Policy > User Configuration > Administrative Template > Windows Component > Windows Explorer > and select the specific drivers from “hide these specific drivers from My Computer”

If you prevent access for My Computer, shortcuts will not be working.