Locking down a system

[Nikto]

Thanks very much for that. Some very useful info. I'd done stuff in the dim and distant (W98) past with policies but hadn't had a need to get involved under W2K or XP.

I assume (and hence your warning) that this configuration applies to all users?

Ken.

It does, indeed. If you create a list of allowed programs without adding gpedit.msc to the list then you cannot run gpedit.msc to change the list. You can, presumably, but not easily afaik, edit the registry to undo this, but only if regedit (or similar) was added to the list of allowable programs. In other words, Handle With Care.

[Nikto]

It does, indeed. If you create a list of allowed programs without adding gpedit.msc to the list then you cannot run gpedit.msc to change the list. You can, presumably, but not easily afaik, edit the registry to undo this, but only if regedit (or similar) was added to the list of allowable programs. In other words, Handle With Care.

Edit: More precisely, as far as I know, it does - I'm no expert on gpedit, and its name (group policy editor) implies that its settings can be applied to groups. I have heard of people getting into real trouble with it, however, so use with caution.

[joshsiao]

Edit: More precisely, as far as I know, it does - I'm no expert on gpedit, and its name (group policy editor) implies that its settings can be applied to groups. I have heard of people getting into real trouble with it, however, so use with caution.

I truly agree. That adds to my list of programs that need caution including the registry, system32 folder, services...

Always ensure you have back-up ready of there is so a need to reformatt due to accidental corruption of the system.