Group Policy on local computer

[Brendan Perez]

I run winxpsp1 on a home network (no domain) and have
just started checking out group policy.

Is there a way to apply group policy to one user on this
computer without it affecting me or the other admins? I
can't seem to find a way to apply GP to someone else, the
help files seem to imply that I need to be in a domain,
etc. Is this true?

[Roger Abell [MVP]]

"Brendan Perez" > wrote in message =
...
> I run winxpsp1 on a home network (no domain) and have=20
> just started checking out group policy.
>=20
> Is there a way to apply group policy to one user on this=20
> computer without it affecting me or the other admins? I=20
> can't seem to find a way to apply GP to someone else, the=20
> help files seem to imply that I need to be in a domain,=20
> etc. Is this true?

Essentially yes, that is true. Local group policy applies=20
to all accounts equally with there being no supported=20
way to do otherwise. However, if one is willing to make=20
some effort . . . =20

It is crude, but you can Deny Full Control, to those accounts=20
that should not be impacted by local policy, on the directory=20
system32\GroupPolicy. For an admin to modify the settings=20
in policy they need to have the Deny effecting them removed,=20
and then replaced when finished with the edit.

In some cases the method outlined in KB 293655 is of use=20
http://support.microsoft.com/?id=3D293655=20

Other than these, you would need to look at third-party=20
tools or direct registry editing in order to effect some of=20
the restrictions policy can, except per user.

--=20
Roger=20

[Roger Abell [MVP]]

"Brendan Perez" > wrote in message =
...
> I run winxpsp1 on a home network (no domain) and have=20
> just started checking out group policy.
>=20
> Is there a way to apply group policy to one user on this=20
> computer without it affecting me or the other admins? I=20
> can't seem to find a way to apply GP to someone else, the=20
> help files seem to imply that I need to be in a domain,=20
> etc. Is this true?

Essentially yes, that is true. Local group policy applies=20
to all accounts equally with there being no supported=20
way to do otherwise. However, if one is willing to make=20
some effort . . . =20

It is crude, but you can Deny Full Control, to those accounts=20
that should not be impacted by local policy, on the directory=20
system32\GroupPolicy. For an admin to modify the settings=20
in policy they need to have the Deny effecting them removed,=20
and then replaced when finished with the edit.

In some cases the method outlined in KB 293655 is of use=20
http://support.microsoft.com/?id=3D293655=20

Other than these, you would need to look at third-party=20
tools or direct registry editing in order to effect some of=20
the restrictions policy can, except per user.

--=20
Roger=20