creating a limited guest account in xp pro?

[MrPolite]

I tried messing around with group policy editor but dunno exactly how to work with it
is there any program that would help me do this? I want to limit the windows guesst account (ie,only let the user run certain applications, etc.)

[ALL]

there are some programs that do that, but xp you cant specify what programs to run unless you install those programs in a spacific users profile. but then you will have to install the programs in each user's account.

[MrPolite]

hmm well do you know any third party apps?

[ALL]

there was one program that i saw on TechTV a long long time ago (when TechTV was good!) that did almost exactly what you are looking for, but i cannot remember the name...

after doing a search i found this program... from the looks of it you can create scripts for every user, intern disallowing certain people to run certain apps... try it out and tell us if that will work:

found here:
http://www.download.com/Scription/30...ml?tag=lst-0-1

more info here:
http://www.sys-manage.com/sites/I_Scription.html

[MrPolite]

SOMEWHAT helpful, but still looking
any more apps anyone knows? please let me know!

[<ABX]

there are some programs that do that, but xp you cant specify what programs to run unless you install those programs in a spacific users profile. but then you will have to install the programs in each user's account.

That is not entirely true.

Would it be acceptable for all other users(other, as in users not affected by the restrictions) of the computer to be local administrators?

If so you can use Software Restriction Settings in secpol.msc (Local Security Policy)

[<ABX]

The Simple way to do deny access to applications is to use basic NTFS permissions and explictly deny the guest account access.

[MrPolite]

hmm not a bad idea
I'd have to set permissions on all programs though

[visualAd]

Have you used the Microsoft Management Console?

1. Goto Start Menu --> Run
2. Type mmc
3. Goto File --> Add / Remove Snap-in
4. Click the Add button
5. From the list choose group policy.
6. Press the finish button and OK all dialog boxes.

You should now have a tree view called local computer policy. There is a policy called "Run only allowed Windows applications" in User configuration --> Administrative Templates --> System. I think this policy applies to all users though, not just guests.

It may also be worth looking in Computer Configuration --> Security Settings --> Local Policies --> User Rights Assignment as there could be some aditional settings for guest accounts there.

[visualAd]

It might be possible to set the restrict programs policy on a per user basis by temporarily making the Guest account and Admin account, logging on as the guest and editing the the registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun

As detailed here. Once you have made the changes, change the account back to a guest account and the policy will remain for the guest user only.

[MrPolite]

Have you used the Microsoft Management Console?

1. Goto Start Menu --> Run
2. Type mmc
3. Goto File --> Add / Remove Snap-in
4. Click the Add button
5. From the list choose group policy.
6. Press the finish button and OK all dialog boxes.

You should now have a tree view called local computer policy. There is a policy called "Run only allowed Windows applications" in User configuration --> Administrative Templates --> System. I think this policy applies to all users though, not just guests.

It may also be worth looking in Computer Configuration --> Security Settings --> Local Policies --> User Rights Assignment as there could be some aditional settings for guest accounts there.

wah interesting thanks!!
p.s. that does not appear to list every management console thingie, or am I missing anything? I couldnt find secpol.msc in that list (the one ABX mentioned)

[MrPolite]

ok we have a problem here
I managed to restrict the account using group policy BUT it restricted my own administrative account too!
here's what I did: as adam said I changed the guest account type of administrative so I could run group policy editor, but when I made all the changes and logged back to my own account, all those changes from gpedit were made to my account too..... this isnt working how would I be able to run gpedit in the guest account, withotu modifying other accounts?
I was editing the User Configurations settings btw

[visualAd]

You have to modify the reistry like I mentioned in post #10. The group policy is global to all users, However, if you modify the HKEY_CURRENT_USER registry key when logged on as guest it will only affect the current user.