1

I've read several Q&A here that each address one of these restrictions, but found none addressing several or all of them together.

Context: Windows XP PCs in teaching labs have two accounts, one with administrator privileges (and a good password, students don't use it) and one with regular user privileges used by all students.

In XP the regular user may:

  1. install software in their account
  2. put files on the desktop
  3. move Desktop icons around
  4. change the desktop wallpaper
  5. change the Programs submenu of the Start menu

I'd like to prevent all these (especially 1, 2, and 3, they usually don't do 4 nor 5). Students must:

  1. ask the admin if they need new software
  2. put their files in a subdirectory of My Documents
      1. not impose their taste on other users

I'm looking for a unified way to accomplish all these. I've read about something called "group policies" that may be the way to go:

  • do you confirm it is?
  • can you tell me the procedure?
  • will this work the same in Windows 7?
L. Levrel
  • 346
  • 2
  • 8
  • Note: See the following Q&A if gpedit is not installed: [Windows Starter Edition, Home and Home Premium do not include gpedit, how do I install it?](http://superuser.com/q/1018145) – DavidPostill Apr 09 '16 at 10:21

1 Answers1

1

Yes, group policies are what you need. You can start the editor by pressing the Windows key + R and typing gpedit.msc. Then you can just navigate around and turn options on and off. It will work almost the same on all Windows versions.

In addition to that you can set UAC to high. If they want to install new software, the computer will ask for an administrator password. You can do this in control panel > user accounts > user accounts > change settings for user account control (or something like that, i am not English). It works on 7, i do not know for sure if it works on XP.

mpboom
  • 154
  • 10
  • 1
    Note: See the following Q&A if gpedit is not installed: [Windows Starter Edition, Home and Home Premium do not include gpedit, how do I install it?](http://superuser.com/q/1018145) – DavidPostill Apr 09 '16 at 10:20
  • @mpboom: Thank you. Upvoted, and I'll accept as soon as I can apply this procedure (not before next week). – L. Levrel Apr 09 '16 at 20:04
  • @David: thanks for the hint. This is XP Pro so it's probably there. Nevertheless it's good to have this reference at hand. – L. Levrel Apr 09 '16 at 20:05
  • @mpboom: this afternoon I could test gpedit. Quite a mess :-) I've found how to lock the wallpaper, the Start menu, and block Add programs in the Control panel (haven't gone to UAC yet). However, I couldn't find an item to forbid moving icons or putting files on the Desktop. There's some stuff about Active directory, which I don't think is used on those PCs. Do I have to turn it on just to forbid changing it (sounds like overkill)? I would greatly appreciate some more details if you can. – L. Levrel Apr 14 '16 at 19:57
  • I am not really into this, but for the not-placing-icons on the desktop you could try logging in to the admin account and change the permissions for the desktop (in the properties window). – mpboom Apr 15 '16 at 07:00
  • Making the Desktop folder read-only has no effect. The regular user can still add files to their desktop. – L. Levrel Apr 15 '16 at 10:17