Question : Help with GPEDIT.MSC

Need a little help locking down an XP Pro workstation in a workgroup environment.  Want to restrict one userid to only running a specific exe and doing nothing else.  I'm figuring to use the group policy editor to do this.  Has anyone done this before?

Answer : Help with GPEDIT.MSC

Restrict Users from Running Specific Applications (Windows 2000/Me/XP) New
Category: Home > Security
This setting allows you to specify applications and filenames that users are restricted from running.

Open your registry and find the key [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Policies\Explorer]

Create a new DWORD value and name it "DisallowRun" set the value to "1" to enable application restrictions or "0" to allow all applications to run.

Then create a new sub-key called [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Policies\Explorer\DisallowRun] and define the applications the are to be restricted. Creating a new string value for each application, named as consecutive numbers, and setting the value to the filename to be restriced (e.g. "regedit.exe").

Restart Windows for the changes to take effect.

Settings
Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\Explorer]
Value Name: DisallowRun



Restrict Applications Users Can Run (All Versions) Updated Popular
Category: Home > Security
Windows gives the ability to restrict the applications that can be run by users on a workstation.

Open your registry and find the key [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Policies\Explorer]

Create a new DWORD value and name it "RestrictRun" set the value to "1" to enable application restrictions or "0" to allow all applications to run.

Then create a new sub-key called [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Policies\Explorer\RestrictRun] and define the applications that are allowed. Creating a new string value for each application, named as consecutive numbers, and setting the value to the filename to be allowed (e.g. "regedit.exe").

Restart Windows for the changes to take effect.

Note: If you are the person who applies Group Policy, do not apply this policy to yourself. If applied too broadly, this policy can prevent administrators from running Group Policy or the registry editors. As a result, once applied, you cannot change this policy except by reinstalling Windows 2000.
 


Settings
Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Policies\Explorer]
Value Name: RestrictRun