Preventing W2k Pro users from accessing the control panel
I have one W2k server that is a DC and 15 Win2k Pros connect to it. I want to hide the control panel from the W2k Pro users. How can I do that from my server so that users can't use the control panel for any purpose?
There are two steps to take. First, use group policy. The Administrative template in the User Configuration, Administrative Templates, Control Panel section lets you selectively determine which control panel applets show up. The explanation section of each heading will tell you exactly how to use it. Use the "show only specified control panel applets" to lessen your chores. Remember, however, that these settings will not prevent the knowledgeable user from running the control panel applet. To prevent them from running the applet, use NTFS file permissions. To find control panel applets, look for files in the %systemroot%\system32 directory that use the .cpl extension. You might also look into using software restriction policies, since those can be done through group policy as well and can prevent any defined software from running.
This was first published in November 2003