Easily restrict access to local group policies

As an advanced setting tool for system administrators, Group Policy includes setting policies for all aspects of the system, which not only enhances the security of the system, but also makes the system more personalized. The settings made to the system through Group Policy are prioritized over the settings made through the control panel, and such settings are often mandatory. Because of this feature of Group Policy, for administrators, setting the system through Group Policy does not want other users to make changes, which will involve the use of Group Policy objects.

Windows XP system, for the Group Policy object of the local computer, the user has permissions are based on the user's account to determine the type, belonging to the administrators group administrator account has a group policy object completely Control permissions, restricted users in the users group cannot access local group policies. Since the XP system does not provide a mechanism for assigning permissions to local Group Policy objects, the permissions for the local Group Policy objects are the same for all accounts in the administrators group, including the system's built-in administrator users, and each user can access them. Local Group Policy and make changes to system policies set by other users. This may cause confusion in the system settings. Can you use other means to enable only the administrator to have access and change the permissions of the local group policy, and restrict the access of other administrators group members to the local group policy?

The local group policy object is saved in the hidden folder "GroupPolicy" under Windows system32. If the partition file system where the XP system is located is in NTFS format, the file and folder security features provided by the NTFS file system are passed. Restricting user access to the folder makes it easy to restrict user access to local group policies.

Set Folder "GroupPolicy" access methods are as follows:

steps a user logs on to the system administrator, open "My Computer", click on the window menu "Tools" in the "Folder Options, click on the "View" tab, in the "Advanced Settings" list, select the "Show all files and folders" option under "Hide files and folders", click "OK";

Steps Open the Windows system32 folder, locate the hidden folder "GroupPolicy", right click and select "Properties";

Step 3 Click the "Security" tab, select "Advanced", cancel "Inherit those from the parent" The selection of the checkboxes of the rights items that can be applied to the sub-objects, including those explicitly defined here; Figure 1

Step 4 Click the "Delete" button in the pop-up information window, at this time the "Permissions" list is cleared, as shown in Figure 1;

step five click the "Add" | "advanced" | "Find Now" in the window Select the "administrator" user in the list below the mouth, click "OK" to return to the previous window, and then click "OK";


Figure 2
Step 6 in the "GroupPolicy permission project" window, click on "permissions" list "allowed" column "full control" selection box, and then click on "OK", as shown in FIG. 2;

step seven click "OK", then you can see A user with only administrator has full control over the folder "GroupPolicy", as shown in Figure 3. Click "OK" to complete the permission settings.
Figure 3
After the permissions are set for the “GroupPolicy” folder, the user can log in to the system with the administrator account to access the local Group Policy object and set and change the policy. After the other members of the administrators group log in to the system, whether by running the mmc command, launching the console to load the "Group Policy" snap-in, or running gpedit.msc to start the Group Policy Editor, the system will display the error shown in Figure 4. information.
Figure 4
take this approach restrict user access to local Group Policy, you need to pay attention to two things:

First, the built-in administrator users have access to the highest principle of the system Any policy settings must be done as an administrator account.

Secondly, format partition where XP system must be NTFS, or can not be allocated to file and folder access permissions.