Shulou(Shulou.com)06/01 Report--

I would like to share with you how to restrict users' access to local group policy. I believe most people don't know much about it, so share this article for your reference. I hope you will learn a lot after reading this article. Let's take a look at it!

As an advanced setting tool for system administrators, group policy includes setting policies in all aspects of the system, which can not only enhance the security of the system, but also make the system more personalized. The priority of setting the system through group policy is higher than that through the control panel, and this setting is often mandatory. Because of this characteristic of group policy, for administrators, the settings made to the system through group policy do not want other users to change, which will involve the use of permissions of group policy objects.

In the Windows XP system, for the group policy object of the local computer, the permissions of the user are determined according to the user's account type, the administrator account belonging to the administrators group has full control over the group policy object, and the restricted users belonging to the users group cannot access the local group policy. Because the XP system does not provide a mechanism for assigning permissions to local group policy objects, all accounts in the administrators group, including administrator users built in the system, have the same permissions on local group policy objects, and each user can access local group policy and change the system policy set by other users. This may cause confusion in system settings, so can only administrator have access to and change the local group policy in other ways, while restricting the access of other administrators group members to the local group policy?

The local group policy object is saved in the hidden folder "GroupPolicy" under\ windows\ system32. If the partition file system where the XP system resides is in NTFS format, with the help of the file and folder security features provided by the NTFS file system, you can easily restrict users' access to the local group policy by restricting users' access to this folder.

The method to set the access to the folder "GroupPolicy" is as follows:

Step 1: log in to the system as an administrator user, open my computer, click folder options in the window menu tools, click the View option page, in the Advanced Settings list, select the Show all Files and folders option under hide Files and folders, and click OK

Step 2: open the\ windows\ system32 folder, locate the hidden folder "GroupPolicy", right-click, and select Properties.

Step 3 Click the Security option page, select Advanced, and deselect the inherit from parent permission items that can be applied to child objects, including those explicitly defined here check box

Step 4 Click the Delete button in the pop-up information window, and the list of permission items is cleared, as shown in figure 1

Step 5, click "add" | "Advanced" | "find now", select the "administrator" user in the list at the bottom of the window, click "OK" to return to the previous window, and then click "OK"

Step 6 in the GroupPolicy permission items window, click the full Control selection box in the allow column in the permissions list, and then click OK, as shown in figure 2

Click OK in step 7, and you can see that only administrator has full control over the folder "GroupPolicy", as shown in figure 3. Click OK to complete the setting of permissions.

After the permissions are set for the "GroupPolicy" folder, users can only access the local Group Policy object and make settings and changes to the policy only if they log on to the system as an administrator account. After members of other administrators groups log in to the system, whether by running the mmc command, launching the console to load the Group Policy snap-in, or running gpedit.msc to start the Group Policy Editor, the system displays the error message shown in figure 4.

When you take this approach to restrict user access to local group policy, you need to pay attention to two points:

First of all, based on the principle that the built-in administrator user has * * access rights, any policy settings for the system must be completed as an administrator account.

Second, the partition format where the XP system resides must be NTFS, otherwise access to files and folders cannot be assigned.

The above is all the contents of the article "how to restrict users' access to Local Group Policy". Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.